531 files changed, 4991 insertions, 2919 deletions

diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index ed122e17636e..7556e7c4a055 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -290,6 +290,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3446"),
                 },
         },
+        {
+        .callback = dmi_disable_osi_win8,
+        .ident = "Dell Vostro 3546",
+        .matches = {
+                    DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                    DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3546"),
+                },
+        },
 
         /*
          * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c
index 143ec6ea1468..7db193160766 100644
--- a/drivers/acpi/device_pm.c
+++ b/drivers/acpi/device_pm.c
@@ -878,7 +878,7 @@ int acpi_dev_suspend_late(struct device *dev)
                 return 0;
 
         target_state = acpi_target_system_state();
-        wakeup = device_may_wakeup(dev);
+        wakeup = device_may_wakeup(dev) && acpi_device_can_wakeup(adev);
         error = acpi_device_wakeup(adev, target_state, wakeup);
         if (wakeup && error)
                 return error;
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index 3d304ff7f095..5f9b74b9b71f 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -126,6 +126,7 @@ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
 static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
 static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
 static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+static int EC_FLAGS_QUERY_HANDSHAKE; /* Needs QR_EC issued when SCI_EVT set */
 
 /* --------------------------------------------------------------------------
  *                           Transaction Management
@@ -236,13 +237,8 @@ static bool advance_transaction(struct acpi_ec *ec)
                 }
                 return wakeup;
         } else {
-                /*
-                 * There is firmware refusing to respond QR_EC when SCI_EVT
-                 * is not set, for which case, we complete the QR_EC
-                 * without issuing it to the firmware.
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=86211
-                 */
-                if (!(status & ACPI_EC_FLAG_SCI) &&
+                if (EC_FLAGS_QUERY_HANDSHAKE &&
+                    !(status & ACPI_EC_FLAG_SCI) &&
                     (t->command == ACPI_EC_COMMAND_QUERY)) {
                         t->flags |= ACPI_EC_COMMAND_POLL;
                         t->rdata[t->ri++] = 0x00;
@@ -334,13 +330,13 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
         pr_debug("***** Command(%s) started *****\n",
                  acpi_ec_cmd_string(t->command));
         start_transaction(ec);
-        spin_unlock_irqrestore(&ec->lock, tmp);
-        ret = ec_poll(ec);
-        spin_lock_irqsave(&ec->lock, tmp);
         if (ec->curr->command == ACPI_EC_COMMAND_QUERY) {
                 clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
                 pr_debug("***** Event stopped *****\n");
         }
+        spin_unlock_irqrestore(&ec->lock, tmp);
+        ret = ec_poll(ec);
+        spin_lock_irqsave(&ec->lock, tmp);
         pr_debug("***** Command(%s) stopped *****\n",
                  acpi_ec_cmd_string(t->command));
         ec->curr = NULL;
@@ -1012,6 +1008,18 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
 }
 
 /*
+ * Acer EC firmware refuses to respond QR_EC when SCI_EVT is not set, for
+ * which case, we complete the QR_EC without issuing it to the firmware.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=86211
+ */
+static int ec_flag_query_handshake(const struct dmi_system_id *id)
+{
+        pr_debug("Detected the EC firmware requiring QR_EC issued when SCI_EVT set\n");
+        EC_FLAGS_QUERY_HANDSHAKE = 1;
+        return 0;
+}
+
+/*
  * On some hardware it is necessary to clear events accumulated by the EC during
  * sleep. These ECs stop reporting GPEs until they are manually polled, if too
  * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
@@ -1085,6 +1093,9 @@ static struct dmi_system_id ec_dmi_table[] __initdata = {
         {
         ec_clear_on_resume, "Samsung hardware", {
         DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
+        {
+        ec_flag_query_handshake, "Acer hardware", {
+        DMI_MATCH(DMI_SYS_VENDOR, "Acer"), }, NULL},
         {},
 };
 
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index d670158a26c5..0476e90b2091 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -142,6 +142,53 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias,
 }
 
 /*
+ * acpi_companion_match() - Can we match via ACPI companion device
+ * @dev: Device in question
+ *
+ * Check if the given device has an ACPI companion and if that companion has
+ * a valid list of PNP IDs, and if the device is the first (primary) physical
+ * device associated with it.
+ *
+ * If multiple physical devices are attached to a single ACPI companion, we need
+ * to be careful.  The usage scenario for this kind of relationship is that all
+ * of the physical devices in question use resources provided by the ACPI
+ * companion.  A typical case is an MFD device where all the sub-devices share
+ * the parent's ACPI companion.  In such cases we can only allow the primary
+ * (first) physical device to be matched with the help of the companion's PNP
+ * IDs.
+ *
+ * Additional physical devices sharing the ACPI companion can still use
+ * resources available from it but they will be matched normally using functions
+ * provided by their bus types (and analogously for their modalias).
+ */
+static bool acpi_companion_match(const struct device *dev)
+{
+        struct acpi_device *adev;
+        bool ret;
+
+        adev = ACPI_COMPANION(dev);
+        if (!adev)
+                return false;
+
+        if (list_empty(&adev->pnp.ids))
+                return false;
+
+        mutex_lock(&adev->physical_node_lock);
+        if (list_empty(&adev->physical_node_list)) {
+                ret = false;
+        } else {
+                const struct acpi_device_physical_node *node;
+
+                node = list_first_entry(&adev->physical_node_list,
+                                        struct acpi_device_physical_node, node);
+                ret = node->dev == dev;
+        }
+        mutex_unlock(&adev->physical_node_lock);
+
+        return ret;
+}
+
+/*
  * Creates uevent modalias field for ACPI enumerated devices.
  * Because the other buses does not support ACPI HIDs & CIDs.
  * e.g. for a device with hid:IBM0001 and cid:ACPI0001 you get:
@@ -149,20 +196,14 @@ static int create_modalias(struct acpi_device *acpi_dev, char *modalias,
  */
 int acpi_device_uevent_modalias(struct device *dev, struct kobj_uevent_env *env)
 {
-        struct acpi_device *acpi_dev;
         int len;
 
-        acpi_dev = ACPI_COMPANION(dev);
-        if (!acpi_dev)
-                return -ENODEV;
-
-        /* Fall back to bus specific way of modalias exporting */
-        if (list_empty(&acpi_dev->pnp.ids))
+        if (!acpi_companion_match(dev))
                 return -ENODEV;
 
         if (add_uevent_var(env, "MODALIAS="))
                 return -ENOMEM;
-        len = create_modalias(acpi_dev, &env->buf[env->buflen - 1],
+        len = create_modalias(ACPI_COMPANION(dev), &env->buf[env->buflen - 1],
                                 sizeof(env->buf) - env->buflen);
         if (len <= 0)
                 return len;
@@ -179,18 +220,12 @@ EXPORT_SYMBOL_GPL(acpi_device_uevent_modalias);
  */
 int acpi_device_modalias(struct device *dev, char *buf, int size)
 {
-        struct acpi_device *acpi_dev;
         int len;
 
-        acpi_dev = ACPI_COMPANION(dev);
-        if (!acpi_dev)
+        if (!acpi_companion_match(dev))
                 return -ENODEV;
 
-        /* Fall back to bus specific way of modalias exporting */
-        if (list_empty(&acpi_dev->pnp.ids))
-                return -ENODEV;
-
-        len = create_modalias(acpi_dev, buf, size -1);
+        len = create_modalias(ACPI_COMPANION(dev), buf, size -1);
         if (len <= 0)
                 return len;
         buf[len++] = '\n';
@@ -853,6 +888,9 @@ const struct acpi_device_id *acpi_match_device(const struct acpi_device_id *ids,
         if (!ids || !handle || acpi_bus_get_device(handle, &adev))
                 return NULL;
 
+        if (!acpi_companion_match(dev))
+                return NULL;
+
         return __acpi_match_device(adev, ids);
 }
 EXPORT_SYMBOL_GPL(acpi_match_device);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 5f039f191067..e45f83789809 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -60,6 +60,7 @@ enum board_ids {
         /* board IDs by feature in alphabetical order */
         board_ahci,
         board_ahci_ign_iferr,
+        board_ahci_nomsi,
         board_ahci_noncq,
         board_ahci_nosntf,
         board_ahci_yes_fbs,
@@ -121,6 +122,13 @@ static const struct ata_port_info ahci_port_info[] = {
                 .udma_mask      = ATA_UDMA6,
                 .port_ops       = &ahci_ops,
         },
+        [board_ahci_nomsi] = {
+                AHCI_HFLAGS     (AHCI_HFLAG_NO_MSI),
+                .flags          = AHCI_FLAG_COMMON,
+                .pio_mask       = ATA_PIO4,
+                .udma_mask      = ATA_UDMA6,
+                .port_ops       = &ahci_ops,
+        },
         [board_ahci_noncq] = {
                 AHCI_HFLAGS     (AHCI_HFLAG_NO_NCQ),
                 .flags          = AHCI_FLAG_COMMON,
@@ -313,6 +321,11 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
+        { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
+        { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
 
         /* JMicron 360/1/3/5/6, match class to avoid IDE function */
         { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
@@ -475,10 +488,10 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
         /*
-         * Samsung SSDs found on some macbooks.  NCQ times out.
-         * https://bugzilla.kernel.org/show_bug.cgi?id=60731
+         * Samsung SSDs found on some macbooks.  NCQ times out if MSI is
+         * enabled.  https://bugzilla.kernel.org/show_bug.cgi?id=60731
          */
-        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_noncq },
+        { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
 
         /* Enmotus */
         { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
@@ -514,12 +527,9 @@ MODULE_PARM_DESC(marvell_enable, "Marvell SATA via AHCI (1 = enabled)");
 static void ahci_pci_save_initial_config(struct pci_dev *pdev,
                                          struct ahci_host_priv *hpriv)
 {
-        unsigned int force_port_map = 0;
-        unsigned int mask_port_map = 0;
-
         if (pdev->vendor == PCI_VENDOR_ID_JMICRON && pdev->device == 0x2361) {
                 dev_info(&pdev->dev, "JMB361 has only one port\n");
-                force_port_map = 1;
+                hpriv->force_port_map = 1;
         }
 
         /*
@@ -529,9 +539,9 @@ static void ahci_pci_save_initial_config(struct pci_dev *pdev,
          */
         if (hpriv->flags & AHCI_HFLAG_MV_PATA) {
                 if (pdev->device == 0x6121)
-                        mask_port_map = 0x3;
+                        hpriv->mask_port_map = 0x3;
                 else
-                        mask_port_map = 0xf;
+                        hpriv->mask_port_map = 0xf;
                 dev_info(&pdev->dev,
                           "Disabling your PATA port. Use the boot option 'ahci.marvell_enable=0' to avoid this.\n");
         }
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 5eb61c9e63da..97683e45ab04 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1778,16 +1778,15 @@ static void ahci_handle_port_interrupt(struct ata_port *ap,
         }
 }
 
-static void ahci_update_intr_status(struct ata_port *ap)
+static void ahci_port_intr(struct ata_port *ap)
 {
         void __iomem *port_mmio = ahci_port_base(ap);
-        struct ahci_port_priv *pp = ap->private_data;
         u32 status;
 
         status = readl(port_mmio + PORT_IRQ_STAT);
         writel(status, port_mmio + PORT_IRQ_STAT);
 
-        atomic_or(status, &pp->intr_status);
+        ahci_handle_port_interrupt(ap, port_mmio, status);
 }
 
 static irqreturn_t ahci_port_thread_fn(int irq, void *dev_instance)
@@ -1808,34 +1807,6 @@ static irqreturn_t ahci_port_thread_fn(int irq, void *dev_instance)
         return IRQ_HANDLED;
 }
 
-irqreturn_t ahci_thread_fn(int irq, void *dev_instance)
-{
-        struct ata_host *host = dev_instance;
-        struct ahci_host_priv *hpriv = host->private_data;
-        u32 irq_masked = hpriv->port_map;
-        unsigned int i;
-
-        for (i = 0; i < host->n_ports; i++) {
-                struct ata_port *ap;
-
-                if (!(irq_masked & (1 << i)))
-                        continue;
-
-                ap = host->ports[i];
-                if (ap) {
-                        ahci_port_thread_fn(irq, ap);
-                        VPRINTK("port %u\n", i);
-                } else {
-                        VPRINTK("port %u (no irq)\n", i);
-                        if (ata_ratelimit())
-                                dev_warn(host->dev,
-                                         "interrupt on disabled port %u\n", i);
-                }
-        }
-
-        return IRQ_HANDLED;
-}
-
 static irqreturn_t ahci_multi_irqs_intr(int irq, void *dev_instance)
 {
         struct ata_port *ap = dev_instance;
@@ -1875,6 +1846,8 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
 
         irq_masked = irq_stat & hpriv->port_map;
 
+        spin_lock(&host->lock);
+
         for (i = 0; i < host->n_ports; i++) {
                 struct ata_port *ap;
 
@@ -1883,7 +1856,7 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
 
                 ap = host->ports[i];
                 if (ap) {
-                        ahci_update_intr_status(ap);
+                        ahci_port_intr(ap);
                         VPRINTK("port %u\n", i);
                 } else {
                         VPRINTK("port %u (no irq)\n", i);
@@ -1906,9 +1879,11 @@ static irqreturn_t ahci_single_irq_intr(int irq, void *dev_instance)
          */
         writel(irq_stat, mmio + HOST_IRQ_STAT);
 
+        spin_unlock(&host->lock);
+
         VPRINTK("EXIT\n");
 
-        return handled ? IRQ_WAKE_THREAD : IRQ_NONE;
+        return IRQ_RETVAL(handled);
 }
 
 unsigned int ahci_qc_issue(struct ata_queued_cmd *qc)
@@ -2320,8 +2295,13 @@ static int ahci_port_start(struct ata_port *ap)
          */
         pp->intr_mask = DEF_PORT_IRQ;
 
-        spin_lock_init(&pp->lock);
-        ap->lock = &pp->lock;
+        /*
+         * Switch to per-port locking in case each port has its own MSI vector.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_MULTI_MSI)) {
+                spin_lock_init(&pp->lock);
+                ap->lock = &pp->lock;
+        }
 
         ap->private_data = pp;
 
@@ -2482,31 +2462,6 @@ out_free_irqs:
         return rc;
 }
 
-static int ahci_host_activate_single_irq(struct ata_host *host, int irq,
-                                         struct scsi_host_template *sht)
-{
-        int i, rc;
-
-        rc = ata_host_start(host);
-        if (rc)
-                return rc;
-
-        rc = devm_request_threaded_irq(host->dev, irq, ahci_single_irq_intr,
-                                       ahci_thread_fn, IRQF_SHARED,
-                                       dev_driver_string(host->dev), host);
-        if (rc)
-                return rc;
-
-        for (i = 0; i < host->n_ports; i++)
-                ata_port_desc(host->ports[i], "irq %d", irq);
-
-        rc = ata_host_register(host, sht);
-        if (rc)
-                devm_free_irq(host->dev, irq, host);
-
-        return rc;
-}
-
 /**
  *      ahci_host_activate - start AHCI host, request IRQs and register it
  *      @host: target ATA host
@@ -2532,7 +2487,8 @@ int ahci_host_activate(struct ata_host *host, int irq,
         if (hpriv->flags & AHCI_HFLAG_MULTI_MSI)
                 rc = ahci_host_activate_multi_irqs(host, irq, sht);
         else
-                rc = ahci_host_activate_single_irq(host, irq, sht);
+                rc = ata_host_activate(host, irq, ahci_single_irq_intr,
+                                       IRQF_SHARED, sht);
         return rc;
 }
 EXPORT_SYMBOL_GPL(ahci_host_activate);
diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
index 61eb6d77dac7..ea1fbc1d4c5f 100644
--- a/drivers/ata/sata_rcar.c
+++ b/drivers/ata/sata_rcar.c
@@ -146,6 +146,7 @@
 enum sata_rcar_type {
         RCAR_GEN1_SATA,
         RCAR_GEN2_SATA,
+        RCAR_R8A7790_ES1_SATA,
 };
 
 struct sata_rcar_priv {
@@ -763,6 +764,9 @@ static void sata_rcar_setup_port(struct ata_host *host)
         ap->udma_mask   = ATA_UDMA6;
         ap->flags       |= ATA_FLAG_SATA;
 
+        if (priv->type == RCAR_R8A7790_ES1_SATA)
+                ap->flags       |= ATA_FLAG_NO_DIPM;
+
         ioaddr->cmd_addr = base + SDATA_REG;
         ioaddr->ctl_addr = base + SSDEVCON_REG;
         ioaddr->scr_addr = base + SCRSSTS_REG;
@@ -792,6 +796,7 @@ static void sata_rcar_init_controller(struct ata_host *host)
                 sata_rcar_gen1_phy_init(priv);
                 break;
         case RCAR_GEN2_SATA:
+        case RCAR_R8A7790_ES1_SATA:
                 sata_rcar_gen2_phy_init(priv);
                 break;
         default:
@@ -838,9 +843,17 @@ static struct of_device_id sata_rcar_match[] = {
                 .data = (void *)RCAR_GEN2_SATA
         },
         {
+                .compatible = "renesas,sata-r8a7790-es1",
+                .data = (void *)RCAR_R8A7790_ES1_SATA
+        },
+        {
                 .compatible = "renesas,sata-r8a7791",
                 .data = (void *)RCAR_GEN2_SATA
         },
+        {
+                .compatible = "renesas,sata-r8a7793",
+                .data = (void *)RCAR_GEN2_SATA
+        },
         { },
 };
 MODULE_DEVICE_TABLE(of, sata_rcar_match);
@@ -849,7 +862,9 @@ static const struct platform_device_id sata_rcar_id_table[] = {
         { "sata_rcar", RCAR_GEN1_SATA }, /* Deprecated by "sata-r8a7779" */
         { "sata-r8a7779", RCAR_GEN1_SATA },
         { "sata-r8a7790", RCAR_GEN2_SATA },
+        { "sata-r8a7790-es1", RCAR_R8A7790_ES1_SATA },
         { "sata-r8a7791", RCAR_GEN2_SATA },
+        { "sata-r8a7793", RCAR_GEN2_SATA },
         { },
 };
 MODULE_DEVICE_TABLE(platform, sata_rcar_id_table);
diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig
index 61a33f4ba608..df04227d00cf 100644
--- a/drivers/base/Kconfig
+++ b/drivers/base/Kconfig
@@ -171,20 +171,23 @@ config WANT_DEV_COREDUMP
           Drivers should "select" this option if they desire to use the
           device coredump mechanism.
 
-config DISABLE_DEV_COREDUMP
-        bool "Disable device coredump" if EXPERT
+config ALLOW_DEV_COREDUMP
+        bool "Allow device coredump" if EXPERT
+        default y
         help
-          Disable the device coredump mechanism despite drivers wanting to
-          use it; this allows for more sensitive systems or systems that
-          don't want to ever access the information to not have the code,
-          nor keep any data.
+          This option controls if the device coredump mechanism is available or
+          not; if disabled, the mechanism will be omitted even if drivers that
+          can use it are enabled.
+          Say 'N' for more sensitive systems or systems that don't want
+          to ever access the information to not have the code, nor keep any
+          data.
 
-          If unsure, say N.
+          If unsure, say Y.
 
 config DEV_COREDUMP
         bool
         default y if WANT_DEV_COREDUMP
-        depends on !DISABLE_DEV_COREDUMP
+        depends on ALLOW_DEV_COREDUMP
 
 config DEBUG_DRIVER
         bool "Driver Core verbose debug messages"
diff --git a/drivers/base/core.c b/drivers/base/core.c
index 14d162952c3b..842d04707de6 100644
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -724,12 +724,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj)
         return &dir->kobj;
 }
 
+static DEFINE_MUTEX(gdp_mutex);
 
 static struct kobject *get_device_parent(struct device *dev,
                                          struct device *parent)
 {
         if (dev->class) {
-                static DEFINE_MUTEX(gdp_mutex);
                 struct kobject *kobj = NULL;
                 struct kobject *parent_kobj;
                 struct kobject *k;
@@ -793,7 +793,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
             glue_dir->kset != &dev->class->p->glue_dirs)
                 return;
 
+        mutex_lock(&gdp_mutex);
         kobject_put(glue_dir);
+        mutex_unlock(&gdp_mutex);
 }
 
 static void cleanup_device_parent(struct device *dev)
diff --git a/drivers/base/dma-contiguous.c b/drivers/base/dma-contiguous.c
index 473ff4892401..950fff9ce453 100644
--- a/drivers/base/dma-contiguous.c
+++ b/drivers/base/dma-contiguous.c
@@ -223,9 +223,10 @@ bool dma_release_from_contiguous(struct device *dev, struct page *pages,
 #undef pr_fmt
 #define pr_fmt(fmt) fmt
 
-static void rmem_cma_device_init(struct reserved_mem *rmem, struct device *dev)
+static int rmem_cma_device_init(struct reserved_mem *rmem, struct device *dev)
 {
         dev_set_cma_area(dev, rmem->priv);
+        return 0;
 }
 
 static void rmem_cma_device_release(struct reserved_mem *rmem,
diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
index 40bc2f4072cc..fb83d4acd400 100644
--- a/drivers/base/power/domain.c
+++ b/drivers/base/power/domain.c
@@ -361,9 +361,19 @@ static int __pm_genpd_save_device(struct pm_domain_data *pdd,
         struct device *dev = pdd->dev;
         int ret = 0;
 
-        if (gpd_data->need_restore)
+        if (gpd_data->need_restore > 0)
                 return 0;
 
+        /*
+         * If the value of the need_restore flag is still unknown at this point,
+         * we trust that pm_genpd_poweroff() has verified that the device is
+         * already runtime PM suspended.
+         */
+        if (gpd_data->need_restore < 0) {
+                gpd_data->need_restore = 1;
+                return 0;
+        }
+
         mutex_unlock(&genpd->lock);
 
         genpd_start_dev(genpd, dev);
@@ -373,7 +383,7 @@ static int __pm_genpd_save_device(struct pm_domain_data *pdd,
         mutex_lock(&genpd->lock);
 
         if (!ret)
-                gpd_data->need_restore = true;
+                gpd_data->need_restore = 1;
 
         return ret;
 }
@@ -389,12 +399,17 @@ static void __pm_genpd_restore_device(struct pm_domain_data *pdd,
 {
         struct generic_pm_domain_data *gpd_data = to_gpd_data(pdd);
         struct device *dev = pdd->dev;
-        bool need_restore = gpd_data->need_restore;
+        int need_restore = gpd_data->need_restore;
 
-        gpd_data->need_restore = false;
+        gpd_data->need_restore = 0;
         mutex_unlock(&genpd->lock);
 
         genpd_start_dev(genpd, dev);
+
+        /*
+         * Call genpd_restore_dev() for recently added devices too (need_restore
+         * is negative then).
+         */
         if (need_restore)
                 genpd_restore_dev(genpd, dev);
 
@@ -603,6 +618,7 @@ static void genpd_power_off_work_fn(struct work_struct *work)
 static int pm_genpd_runtime_suspend(struct device *dev)
 {
         struct generic_pm_domain *genpd;
+        struct generic_pm_domain_data *gpd_data;
         bool (*stop_ok)(struct device *__dev);
         int ret;
 
@@ -628,6 +644,16 @@ static int pm_genpd_runtime_suspend(struct device *dev)
                 return 0;
 
         mutex_lock(&genpd->lock);
+
+        /*
+         * If we have an unknown state of the need_restore flag, it means none
+         * of the runtime PM callbacks has been invoked yet. Let's update the
+         * flag to reflect that the current state is active.
+         */
+        gpd_data = to_gpd_data(dev->power.subsys_data->domain_data);
+        if (gpd_data->need_restore < 0)
+                gpd_data->need_restore = 0;
+
         genpd->in_progress++;
         pm_genpd_poweroff(genpd);
         genpd->in_progress--;
@@ -1437,12 +1463,12 @@ int __pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev,
         spin_unlock_irq(&dev->power.lock);
 
         if (genpd->attach_dev)
-                genpd->attach_dev(dev);
+                genpd->attach_dev(genpd, dev);
 
         mutex_lock(&gpd_data->lock);
         gpd_data->base.dev = dev;
         list_add_tail(&gpd_data->base.list_node, &genpd->dev_list);
-        gpd_data->need_restore = genpd->status == GPD_STATE_POWER_OFF;
+        gpd_data->need_restore = -1;
         gpd_data->td.constraint_changed = true;
         gpd_data->td.effective_constraint_ns = -1;
         mutex_unlock(&gpd_data->lock);
@@ -1499,7 +1525,7 @@ int pm_genpd_remove_device(struct generic_pm_domain *genpd,
         genpd->max_off_time_changed = true;
 
         if (genpd->detach_dev)
-                genpd->detach_dev(dev);
+                genpd->detach_dev(genpd, dev);
 
         spin_lock_irq(&dev->power.lock);
 
@@ -1546,7 +1572,7 @@ void pm_genpd_dev_need_restore(struct device *dev, bool val)
 
         psd = dev_to_psd(dev);
         if (psd && psd->domain_data)
-                to_gpd_data(psd->domain_data)->need_restore = val;
+                to_gpd_data(psd->domain_data)->need_restore = val ? 1 : 0;
 
         spin_unlock_irqrestore(&dev->power.lock, flags);
 }
diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
index 44973196d3fd..9717d5f20139 100644
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1266,6 +1266,8 @@ int dpm_suspend_late(pm_message_t state)
         }
         mutex_unlock(&dpm_list_mtx);
         async_synchronize_full();
+        if (!error)
+                error = async_error;
         if (error) {
                 suspend_stats.failed_suspend_late++;
                 dpm_save_failed_step(SUSPEND_SUSPEND_LATE);
diff --git a/drivers/bcma/host_pci.c b/drivers/bcma/host_pci.c
index 1e5ac0a79696..cd9161a8b3a1 100644
--- a/drivers/bcma/host_pci.c
+++ b/drivers/bcma/host_pci.c
@@ -275,7 +275,7 @@ static SIMPLE_DEV_PM_OPS(bcma_pm_ops, bcma_host_pci_suspend,
 static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x0576) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4313) },
-        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43224) },  /* 0xa8d8 */
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4331) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4353) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4357) },
@@ -285,7 +285,8 @@ static const struct pci_device_id bcma_pci_bridge_tbl[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43a9) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x43aa) },
         { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 0x4727) },
-        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xA8DB */
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43227) },  /* 0xa8db, BCM43217 (sic!) */
+        { PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, 43228) },  /* 0xa8dc */
         { 0, },
 };
 MODULE_DEVICE_TABLE(pci, bcma_pci_bridge_tbl);
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index d1656c2f70af..1000955ce09d 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -132,7 +132,7 @@ static bool bcma_is_core_needed_early(u16 core_id)
         return false;
 }
 
-#ifdef CONFIG_OF
+#if defined(CONFIG_OF) && defined(CONFIG_OF_ADDRESS)
 static struct device_node *bcma_of_find_child_device(struct platform_device *parent,
                                                      struct bcma_device *core)
 {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index 2671a3f02f0c..8001e812018b 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -450,14 +450,10 @@ static int init_driver_queues(struct nullb *nullb)
 
                 ret = setup_commands(nq);
                 if (ret)
-                        goto err_queue;
+                        return ret;
                 nullb->nr_queues++;
         }
-
         return 0;
-err_queue:
-        cleanup_queues(nullb);
-        return ret;
 }
 
 static int null_add_dev(void)
@@ -507,7 +503,9 @@ static int null_add_dev(void)
                         goto out_cleanup_queues;
                 }
                 blk_queue_make_request(nullb->q, null_queue_bio);
-                init_driver_queues(nullb);
+                rv = init_driver_queues(nullb);
+                if (rv)
+                        goto out_cleanup_blk_queue;
         } else {
                 nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                 if (!nullb->q) {
@@ -516,7 +514,9 @@ static int null_add_dev(void)
                 }
                 blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                 blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
-                init_driver_queues(nullb);
+                rv = init_driver_queues(nullb);
+                if (rv)
+                        goto out_cleanup_blk_queue;
         }
 
         nullb->q->queuedata = nullb;
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 0a54c588e433..27b71a0b72d0 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -342,7 +342,6 @@ struct rbd_device {
 
         struct list_head        rq_queue;       /* incoming rq queue */
         spinlock_t              lock;           /* queue, flags, open_count */
-        struct workqueue_struct *rq_wq;
         struct work_struct      rq_work;
 
         struct rbd_image_header header;
@@ -402,6 +401,8 @@ static struct kmem_cache	*rbd_segment_name_cache;
 static int rbd_major;
 static DEFINE_IDA(rbd_dev_id_ida);
 
+static struct workqueue_struct *rbd_wq;
+
 /*
  * Default to false for now, as single-major requires >= 0.75 version of
  * userspace rbd utility.
@@ -3452,7 +3453,7 @@ static void rbd_request_fn(struct request_queue *q)
         }
 
         if (queued)
-                queue_work(rbd_dev->rq_wq, &rbd_dev->rq_work);
+                queue_work(rbd_wq, &rbd_dev->rq_work);
 }
 
 /*
@@ -3532,7 +3533,7 @@ static int rbd_obj_read_sync(struct rbd_device *rbd_dev,
         page_count = (u32) calc_pages_for(offset, length);
         pages = ceph_alloc_page_vector(page_count, GFP_KERNEL);
         if (IS_ERR(pages))
-                ret = PTR_ERR(pages);
+                return PTR_ERR(pages);
 
         ret = -ENOMEM;
         obj_request = rbd_obj_request_create(object_name, offset, length,
@@ -5242,16 +5243,9 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
         set_capacity(rbd_dev->disk, rbd_dev->mapping.size / SECTOR_SIZE);
         set_disk_ro(rbd_dev->disk, rbd_dev->mapping.read_only);
 
-        rbd_dev->rq_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0,
-                                         rbd_dev->disk->disk_name);
-        if (!rbd_dev->rq_wq) {
-                ret = -ENOMEM;
-                goto err_out_mapping;
-        }
-
         ret = rbd_bus_add_dev(rbd_dev);
         if (ret)
-                goto err_out_workqueue;
+                goto err_out_mapping;
 
         /* Everything's ready.  Announce the disk to the world. */
 
@@ -5263,9 +5257,6 @@ static int rbd_dev_device_setup(struct rbd_device *rbd_dev)
 
         return ret;
 
-err_out_workqueue:
-        destroy_workqueue(rbd_dev->rq_wq);
-        rbd_dev->rq_wq = NULL;
 err_out_mapping:
         rbd_dev_mapping_clear(rbd_dev);
 err_out_disk:
@@ -5512,7 +5503,6 @@ static void rbd_dev_device_release(struct device *dev)
 {
         struct rbd_device *rbd_dev = dev_to_rbd_dev(dev);
 
-        destroy_workqueue(rbd_dev->rq_wq);
         rbd_free_disk(rbd_dev);
         clear_bit(RBD_DEV_FLAG_EXISTS, &rbd_dev->flags);
         rbd_dev_mapping_clear(rbd_dev);
@@ -5716,11 +5706,21 @@ static int __init rbd_init(void)
         if (rc)
                 return rc;
 
+        /*
+         * The number of active work items is limited by the number of
+         * rbd devices, so leave @max_active at default.
+         */
+        rbd_wq = alloc_workqueue(RBD_DRV_NAME, WQ_MEM_RECLAIM, 0);
+        if (!rbd_wq) {
+                rc = -ENOMEM;
+                goto err_out_slab;
+        }
+
         if (single_major) {
                 rbd_major = register_blkdev(0, RBD_DRV_NAME);
                 if (rbd_major < 0) {
                         rc = rbd_major;
-                        goto err_out_slab;
+                        goto err_out_wq;
                 }
         }
 
@@ -5738,6 +5738,8 @@ static int __init rbd_init(void)
 err_out_blkdev:
         if (single_major)
                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
+err_out_wq:
+        destroy_workqueue(rbd_wq);
 err_out_slab:
         rbd_slab_exit();
         return rc;
@@ -5749,6 +5751,7 @@ static void __exit rbd_exit(void)
         rbd_sysfs_cleanup();
         if (single_major)
                 unregister_blkdev(rbd_major, RBD_DRV_NAME);
+        destroy_workqueue(rbd_wq);
         rbd_slab_exit();
 }
 
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 756b8ec00f16..0ebadf93b6c5 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -69,8 +69,6 @@ struct vdc_port {
         u8                      vdisk_mtype;
 
         char                    disk_name[32];
-
-        struct vio_disk_vtoc    label;
 };
 
 static inline struct vdc_port *to_vdc_port(struct vio_driver_state *vio)
@@ -710,13 +708,6 @@ static int probe_disk(struct vdc_port *port)
         if (comp.err)
                 return comp.err;
 
-        err = generic_request(port, VD_OP_GET_VTOC,
-                              &port->label, sizeof(port->label));
-        if (err < 0) {
-                printk(KERN_ERR PFX "VD_OP_GET_VTOC returns error %d\n", err);
-                return err;
-        }
-
         if (vdc_version_supported(port, 1, 1)) {
                 /* vdisk_size should be set during the handshake, if it wasn't
                  * then the underlying disk is reserved by another system
diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index 0e63e8aa8279..3920ee45aa59 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -99,11 +99,12 @@ static ssize_t mem_used_total_show(struct device *dev,
 {
         u64 val = 0;
         struct zram *zram = dev_to_zram(dev);
-        struct zram_meta *meta = zram->meta;
 
         down_read(&zram->init_lock);
-        if (init_done(zram))
+        if (init_done(zram)) {
+                struct zram_meta *meta = zram->meta;
                 val = zs_get_total_pages(meta->mem_pool);
+        }
         up_read(&zram->init_lock);
 
         return scnprintf(buf, PAGE_SIZE, "%llu\n", val << PAGE_SHIFT);
@@ -173,16 +174,17 @@ static ssize_t mem_used_max_store(struct device *dev,
         int err;
         unsigned long val;
         struct zram *zram = dev_to_zram(dev);
-        struct zram_meta *meta = zram->meta;
 
         err = kstrtoul(buf, 10, &val);
         if (err || val != 0)
                 return -EINVAL;
 
         down_read(&zram->init_lock);
-        if (init_done(zram))
+        if (init_done(zram)) {
+                struct zram_meta *meta = zram->meta;
                 atomic_long_set(&zram->stats.max_used_pages,
                                 zs_get_total_pages(meta->mem_pool));
+        }
         up_read(&zram->init_lock);
 
         return len;
@@ -558,7 +560,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         }
 
         if (page_zero_filled(uncmem)) {
-                kunmap_atomic(user_mem);
+                if (user_mem)
+                        kunmap_atomic(user_mem);
                 /* Free memory associated with this sector now. */
                 bit_spin_lock(ZRAM_ACCESS, &meta->table[index].value);
                 zram_free_page(zram, index);
diff --git a/drivers/char/hw_random/pseries-rng.c b/drivers/char/hw_random/pseries-rng.c
index 6226aa08c36a..bcf86f91800a 100644
--- a/drivers/char/hw_random/pseries-rng.c
+++ b/drivers/char/hw_random/pseries-rng.c
@@ -25,18 +25,21 @@
 #include <asm/vio.h>
 
 
-static int pseries_rng_data_read(struct hwrng *rng, u32 *data)
+static int pseries_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 {
+        u64 buffer[PLPAR_HCALL_BUFSIZE];
+        size_t size = max < 8 ? max : 8;
         int rc;
 
-        rc = plpar_hcall(H_RANDOM, (unsigned long *)data);
+        rc = plpar_hcall(H_RANDOM, (unsigned long *)buffer);
         if (rc != H_SUCCESS) {
                 pr_err_ratelimited("H_RANDOM call failed %d\n", rc);
                 return -EIO;
         }
+        memcpy(data, buffer, size);
 
         /* The hypervisor interface returns 64 bits */
-        return 8;
+        return size;
 }
 
 /**
@@ -55,7 +58,7 @@ static unsigned long pseries_rng_get_desired_dma(struct vio_dev *vdev)
 
 static struct hwrng pseries_rng = {
         .name           = KBUILD_MODNAME,
-        .data_read      = pseries_rng_data_read,
+        .read           = pseries_rng_read,
 };
 
 static int __init pseries_rng_probe(struct vio_dev *dev,
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index bfa640023e64..cf7a561fad7c 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1449,8 +1449,6 @@ static int add_port(struct ports_device *portdev, u32 id)
         spin_lock_init(&port->outvq_lock);
         init_waitqueue_head(&port->waitqueue);
 
-        virtio_device_ready(portdev->vdev);
-
         /* Fill the in_vq with buffers so the host can send us data. */
         nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock);
         if (!nr_added_bufs) {
@@ -2026,6 +2024,8 @@ static int virtcons_probe(struct virtio_device *vdev)
         spin_lock_init(&portdev->ports_lock);
         INIT_LIST_HEAD(&portdev->ports);
 
+        virtio_device_ready(portdev->vdev);
+
         if (multiport) {
                 unsigned int nr_added_bufs;
 
diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c
index 2133f9d59d06..43005d4d3348 100644
--- a/drivers/clocksource/arm_arch_timer.c
+++ b/drivers/clocksource/arm_arch_timer.c
@@ -660,11 +660,11 @@ static bool __init
 arch_timer_probed(int type, const struct of_device_id *matches)
 {
         struct device_node *dn;
-        bool probed = false;
+        bool probed = true;
 
         dn = of_find_matching_node(NULL, matches);
-        if (dn && of_device_is_available(dn) && (arch_timers_present & type))
-                probed = true;
+        if (dn && of_device_is_available(dn) && !(arch_timers_present & type))
+                probed = false;
         of_node_put(dn);
 
         return probed;
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index efb17c3ee120..f4a9c0058b4d 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -182,6 +182,12 @@ static void __init sun4i_timer_init(struct device_node *node)
         /* Make sure timer is stopped before playing with interrupts */
         sun4i_clkevt_time_stop(0);
 
+        sun4i_clockevent.cpumask = cpu_possible_mask;
+        sun4i_clockevent.irq = irq;
+
+        clockevents_config_and_register(&sun4i_clockevent, rate,
+                                        TIMER_SYNC_TICKS, 0xffffffff);
+
         ret = setup_irq(irq, &sun4i_timer_irq);
         if (ret)
                 pr_warn("failed to setup irq %d\n", irq);
@@ -189,12 +195,6 @@ static void __init sun4i_timer_init(struct device_node *node)
         /* Enable timer0 interrupt */
         val = readl(timer_base + TIMER_IRQ_EN_REG);
         writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
-
-        sun4i_clockevent.cpumask = cpu_possible_mask;
-        sun4i_clockevent.irq = irq;
-
-        clockevents_config_and_register(&sun4i_clockevent, rate,
-                                        TIMER_SYNC_TICKS, 0xffffffff);
 }
 CLOCKSOURCE_OF_DECLARE(sun4i, "allwinner,sun4i-a10-timer",
                        sun4i_timer_init);
diff --git a/drivers/cpufreq/cpufreq-dt.c b/drivers/cpufreq/cpufreq-dt.c
index 92c162af5045..f657c571b18e 100644
--- a/drivers/cpufreq/cpufreq-dt.c
+++ b/drivers/cpufreq/cpufreq-dt.c
@@ -166,8 +166,8 @@ try_again:
                 if (ret == -EPROBE_DEFER)
                         dev_dbg(cpu_dev, "cpu%d clock not ready, retry\n", cpu);
                 else
-                        dev_err(cpu_dev, "failed to get cpu%d clock: %d\n", ret,
-                                cpu);
+                        dev_err(cpu_dev, "failed to get cpu%d clock: %d\n", cpu,
+                                ret);
         } else {
                 *cdev = cpu_dev;
                 *creg = cpu_reg;
@@ -187,6 +187,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         struct device *cpu_dev;
         struct regulator *cpu_reg;
         struct clk *cpu_clk;
+        unsigned long min_uV = ~0, max_uV = 0;
         unsigned int transition_latency;
         int ret;
 
@@ -206,16 +207,10 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         /* OPPs might be populated at runtime, don't check for error here */
         of_init_opp_table(cpu_dev);
 
-        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
-        if (ret) {
-                dev_err(cpu_dev, "failed to init cpufreq table: %d\n", ret);
-                goto out_put_node;
-        }
-
         priv = kzalloc(sizeof(*priv), GFP_KERNEL);
         if (!priv) {
                 ret = -ENOMEM;
-                goto out_free_table;
+                goto out_put_node;
         }
 
         of_property_read_u32(np, "voltage-tolerance", &priv->voltage_tolerance);
@@ -224,30 +219,51 @@ static int cpufreq_init(struct cpufreq_policy *policy)
                 transition_latency = CPUFREQ_ETERNAL;
 
         if (!IS_ERR(cpu_reg)) {
-                struct dev_pm_opp *opp;
-                unsigned long min_uV, max_uV;
-                int i;
+                unsigned long opp_freq = 0;
 
                 /*
-                 * OPP is maintained in order of increasing frequency, and
-                 * freq_table initialised from OPP is therefore sorted in the
-                 * same order.
+                 * Disable any OPPs where the connected regulator isn't able to
+                 * provide the specified voltage and record minimum and maximum
+                 * voltage levels.
                  */
-                for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++)
-                        ;
-                rcu_read_lock();
-                opp = dev_pm_opp_find_freq_exact(cpu_dev,
-                                freq_table[0].frequency * 1000, true);
-                min_uV = dev_pm_opp_get_voltage(opp);
-                opp = dev_pm_opp_find_freq_exact(cpu_dev,
-                                freq_table[i-1].frequency * 1000, true);
-                max_uV = dev_pm_opp_get_voltage(opp);
-                rcu_read_unlock();
+                while (1) {
+                        struct dev_pm_opp *opp;
+                        unsigned long opp_uV, tol_uV;
+
+                        rcu_read_lock();
+                        opp = dev_pm_opp_find_freq_ceil(cpu_dev, &opp_freq);
+                        if (IS_ERR(opp)) {
+                                rcu_read_unlock();
+                                break;
+                        }
+                        opp_uV = dev_pm_opp_get_voltage(opp);
+                        rcu_read_unlock();
+
+                        tol_uV = opp_uV * priv->voltage_tolerance / 100;
+                        if (regulator_is_supported_voltage(cpu_reg, opp_uV,
+                                                           opp_uV + tol_uV)) {
+                                if (opp_uV < min_uV)
+                                        min_uV = opp_uV;
+                                if (opp_uV > max_uV)
+                                        max_uV = opp_uV;
+                        } else {
+                                dev_pm_opp_disable(cpu_dev, opp_freq);
+                        }
+
+                        opp_freq++;
+                }
+
                 ret = regulator_set_voltage_time(cpu_reg, min_uV, max_uV);
                 if (ret > 0)
                         transition_latency += ret * 1000;
         }
 
+        ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &freq_table);
+        if (ret) {
+                pr_err("failed to init cpufreq table: %d\n", ret);
+                goto out_free_priv;
+        }
+
         /*
          * For now, just loading the cooling device;
          * thermal DT code takes care of matching them.
@@ -277,7 +293,7 @@ static int cpufreq_init(struct cpufreq_policy *policy)
         policy->cpuinfo.transition_latency = transition_latency;
 
         pd = cpufreq_get_driver_data();
-        if (pd && !pd->independent_clocks)
+        if (!pd || !pd->independent_clocks)
                 cpumask_setall(policy->cpus);
 
         of_node_put(np);
@@ -286,9 +302,9 @@ static int cpufreq_init(struct cpufreq_policy *policy)
 
 out_cooling_unregister:
         cpufreq_cooling_unregister(priv->cdev);
-        kfree(priv);
-out_free_table:
         dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
+out_free_priv:
+        kfree(priv);
 out_put_node:
         of_node_put(np);
 out_put_reg_clk:
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 644b54e1e7d1..4473eba1d6b0 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1022,7 +1022,8 @@ static struct cpufreq_policy *cpufreq_policy_restore(unsigned int cpu)
 
         read_unlock_irqrestore(&cpufreq_driver_lock, flags);
 
-        policy->governor = NULL;
+        if (policy)
+                policy->governor = NULL;
 
         return policy;
 }
diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c
index 871703c49d2c..e1eaf4ff9762 100644
--- a/drivers/crypto/caam/key_gen.c
+++ b/drivers/crypto/caam/key_gen.c
@@ -48,23 +48,29 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
         u32 *desc;
         struct split_key_result result;
         dma_addr_t dma_addr_in, dma_addr_out;
-        int ret = 0;
+        int ret = -ENOMEM;
 
         desc = kmalloc(CAAM_CMD_SZ * 6 + CAAM_PTR_SZ * 2, GFP_KERNEL | GFP_DMA);
         if (!desc) {
                 dev_err(jrdev, "unable to allocate key input memory\n");
-                return -ENOMEM;
+                return ret;
         }
 
-        init_job_desc(desc, 0);
-
         dma_addr_in = dma_map_single(jrdev, (void *)key_in, keylen,
                                      DMA_TO_DEVICE);
         if (dma_mapping_error(jrdev, dma_addr_in)) {
                 dev_err(jrdev, "unable to map key input memory\n");
-                kfree(desc);
-                return -ENOMEM;
+                goto out_free;
         }
+
+        dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
+                                      DMA_FROM_DEVICE);
+        if (dma_mapping_error(jrdev, dma_addr_out)) {
+                dev_err(jrdev, "unable to map key output memory\n");
+                goto out_unmap_in;
+        }
+
+        init_job_desc(desc, 0);
         append_key(desc, dma_addr_in, keylen, CLASS_2 | KEY_DEST_CLASS_REG);
 
         /* Sets MDHA up into an HMAC-INIT */
@@ -81,13 +87,6 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
          * FIFO_STORE with the explicit split-key content store
          * (0x26 output type)
          */
-        dma_addr_out = dma_map_single(jrdev, key_out, split_key_pad_len,
-                                      DMA_FROM_DEVICE);
-        if (dma_mapping_error(jrdev, dma_addr_out)) {
-                dev_err(jrdev, "unable to map key output memory\n");
-                kfree(desc);
-                return -ENOMEM;
-        }
         append_fifo_store(desc, dma_addr_out, split_key_len,
                           LDST_CLASS_2_CCB | FIFOST_TYPE_SPLIT_KEK);
 
@@ -115,10 +114,10 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len,
 
         dma_unmap_single(jrdev, dma_addr_out, split_key_pad_len,
                          DMA_FROM_DEVICE);
+out_unmap_in:
         dma_unmap_single(jrdev, dma_addr_in, keylen, DMA_TO_DEVICE);
-
+out_free:
         kfree(desc);
-
         return ret;
 }
 EXPORT_SYMBOL(gen_split_key);
diff --git a/drivers/crypto/qat/qat_common/adf_accel_devices.h b/drivers/crypto/qat/qat_common/adf_accel_devices.h
index 9282381b03ce..fe7b3f06f6e6 100644
--- a/drivers/crypto/qat/qat_common/adf_accel_devices.h
+++ b/drivers/crypto/qat/qat_common/adf_accel_devices.h
@@ -198,8 +198,7 @@ struct adf_accel_dev {
         struct dentry *debugfs_dir;
         struct list_head list;
         struct module *owner;
-        uint8_t accel_id;
-        uint8_t numa_node;
         struct adf_accel_pci accel_pci_dev;
+        uint8_t accel_id;
 } __packed;
 #endif
diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c
index 5f3fa45348b4..9dd2cb72a4e8 100644
--- a/drivers/crypto/qat/qat_common/adf_transport.c
+++ b/drivers/crypto/qat/qat_common/adf_transport.c
@@ -419,9 +419,10 @@ static int adf_init_bank(struct adf_accel_dev *accel_dev,
                 WRITE_CSR_RING_BASE(csr_addr, bank_num, i, 0);
                 ring = &bank->rings[i];
                 if (hw_data->tx_rings_mask & (1 << i)) {
-                        ring->inflights = kzalloc_node(sizeof(atomic_t),
-                                                       GFP_KERNEL,
-                                                       accel_dev->numa_node);
+                        ring->inflights =
+                                kzalloc_node(sizeof(atomic_t),
+                                             GFP_KERNEL,
+                                             dev_to_node(&GET_DEV(accel_dev)));
                         if (!ring->inflights)
                                 goto err;
                 } else {
@@ -469,13 +470,14 @@ int adf_init_etr_data(struct adf_accel_dev *accel_dev)
         int i, ret;
 
         etr_data = kzalloc_node(sizeof(*etr_data), GFP_KERNEL,
-                                accel_dev->numa_node);
+                                dev_to_node(&GET_DEV(accel_dev)));
         if (!etr_data)
                 return -ENOMEM;
 
         num_banks = GET_MAX_BANKS(accel_dev);
         size = num_banks * sizeof(struct adf_etr_bank_data);
-        etr_data->banks = kzalloc_node(size, GFP_KERNEL, accel_dev->numa_node);
+        etr_data->banks = kzalloc_node(size, GFP_KERNEL,
+                                       dev_to_node(&GET_DEV(accel_dev)));
         if (!etr_data->banks) {
                 ret = -ENOMEM;
                 goto err_bank;
diff --git a/drivers/crypto/qat/qat_common/qat_algs.c b/drivers/crypto/qat/qat_common/qat_algs.c
index f2e2f158cfbe..9e9619cd4a79 100644
--- a/drivers/crypto/qat/qat_common/qat_algs.c
+++ b/drivers/crypto/qat/qat_common/qat_algs.c
@@ -596,7 +596,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
         if (unlikely(!n))
                 return -EINVAL;
 
-        bufl = kmalloc_node(sz, GFP_ATOMIC, inst->accel_dev->numa_node);
+        bufl = kmalloc_node(sz, GFP_ATOMIC,
+                            dev_to_node(&GET_DEV(inst->accel_dev)));
         if (unlikely(!bufl))
                 return -ENOMEM;
 
@@ -605,6 +606,8 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
                 goto err;
 
         for_each_sg(assoc, sg, assoc_n, i) {
+                if (!sg->length)
+                        continue;
                 bufl->bufers[bufs].addr = dma_map_single(dev,
                                                          sg_virt(sg),
                                                          sg->length,
@@ -640,7 +643,7 @@ static int qat_alg_sgl_to_bufl(struct qat_crypto_instance *inst,
                 struct qat_alg_buf *bufers;
 
                 buflout = kmalloc_node(sz, GFP_ATOMIC,
-                                       inst->accel_dev->numa_node);
+                                       dev_to_node(&GET_DEV(inst->accel_dev)));
                 if (unlikely(!buflout))
                         goto err;
                 bloutp = dma_map_single(dev, buflout, sz, DMA_TO_DEVICE);
diff --git a/drivers/crypto/qat/qat_common/qat_crypto.c b/drivers/crypto/qat/qat_common/qat_crypto.c
index 0d59bcb50de1..828f2a686aab 100644
--- a/drivers/crypto/qat/qat_common/qat_crypto.c
+++ b/drivers/crypto/qat/qat_common/qat_crypto.c
@@ -109,12 +109,14 @@ struct qat_crypto_instance *qat_crypto_get_instance_node(int node)
 
         list_for_each(itr, adf_devmgr_get_head()) {
                 accel_dev = list_entry(itr, struct adf_accel_dev, list);
-                if (accel_dev->numa_node == node && adf_dev_started(accel_dev))
+                if ((node == dev_to_node(&GET_DEV(accel_dev)) ||
+                        dev_to_node(&GET_DEV(accel_dev)) < 0)
+                                && adf_dev_started(accel_dev))
                         break;
                 accel_dev = NULL;
         }
         if (!accel_dev) {
-                pr_err("QAT: Could not find device on give node\n");
+                pr_err("QAT: Could not find device on node %d\n", node);
                 accel_dev = adf_devmgr_get_first();
         }
         if (!accel_dev || !adf_dev_started(accel_dev))
@@ -164,7 +166,7 @@ static int qat_crypto_create_instances(struct adf_accel_dev *accel_dev)
 
         for (i = 0; i < num_inst; i++) {
                 inst = kzalloc_node(sizeof(*inst), GFP_KERNEL,
-                                    accel_dev->numa_node);
+                                    dev_to_node(&GET_DEV(accel_dev)));
                 if (!inst)
                         goto err;
 
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
index 978d6c56639d..53c491b59f07 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_admin.c
@@ -108,7 +108,7 @@ int adf_init_admin_comms(struct adf_accel_dev *accel_dev)
         uint64_t reg_val;
 
         admin = kzalloc_node(sizeof(*accel_dev->admin), GFP_KERNEL,
-                             accel_dev->numa_node);
+                             dev_to_node(&GET_DEV(accel_dev)));
         if (!admin)
                 return -ENOMEM;
         admin->virt_addr = dma_zalloc_coherent(&GET_DEV(accel_dev), PAGE_SIZE,
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
index 0d0435a41be9..948f66be262b 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_drv.c
@@ -119,21 +119,6 @@ static void adf_cleanup_accel(struct adf_accel_dev *accel_dev)
         kfree(accel_dev);
 }
 
-static uint8_t adf_get_dev_node_id(struct pci_dev *pdev)
-{
-        unsigned int bus_per_cpu = 0;
-        struct cpuinfo_x86 *c = &cpu_data(num_online_cpus() - 1);
-
-        if (!c->phys_proc_id)
-                return 0;
-
-        bus_per_cpu = 256 / (c->phys_proc_id + 1);
-
-        if (bus_per_cpu != 0)
-                return pdev->bus->number / bus_per_cpu;
-        return 0;
-}
-
 static int qat_dev_start(struct adf_accel_dev *accel_dev)
 {
         int cpus = num_online_cpus();
@@ -235,7 +220,6 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         void __iomem *pmisc_bar_addr = NULL;
         char name[ADF_DEVICE_NAME_LENGTH];
         unsigned int i, bar_nr;
-        uint8_t node;
         int ret;
 
         switch (ent->device) {
@@ -246,12 +230,19 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                 return -ENODEV;
         }
 
-        node = adf_get_dev_node_id(pdev);
-        accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL, node);
+        if (num_possible_nodes() > 1 && dev_to_node(&pdev->dev) < 0) {
+                /* If the accelerator is connected to a node with no memory
+                 * there is no point in using the accelerator since the remote
+                 * memory transaction will be very slow. */
+                dev_err(&pdev->dev, "Invalid NUMA configuration.\n");
+                return -EINVAL;
+        }
+
+        accel_dev = kzalloc_node(sizeof(*accel_dev), GFP_KERNEL,
+                                 dev_to_node(&pdev->dev));
         if (!accel_dev)
                 return -ENOMEM;
 
-        accel_dev->numa_node = node;
         INIT_LIST_HEAD(&accel_dev->crypto_list);
 
         /* Add accel device to accel table.
@@ -264,7 +255,8 @@ static int adf_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         accel_dev->owner = THIS_MODULE;
         /* Allocate and configure device configuration structure */
-        hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL, node);
+        hw_data = kzalloc_node(sizeof(*hw_data), GFP_KERNEL,
+                               dev_to_node(&pdev->dev));
         if (!hw_data) {
                 ret = -ENOMEM;
                 goto out_err;
diff --git a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
index 67ec61e51185..d96ee21b9b77 100644
--- a/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
+++ b/drivers/crypto/qat/qat_dh895xcc/adf_isr.c
@@ -168,7 +168,7 @@ static int adf_isr_alloc_msix_entry_table(struct adf_accel_dev *accel_dev)
         uint32_t msix_num_entries = hw_data->num_banks + 1;
 
         entries = kzalloc_node(msix_num_entries * sizeof(*entries),
-                               GFP_KERNEL, accel_dev->numa_node);
+                               GFP_KERNEL, dev_to_node(&GET_DEV(accel_dev)));
         if (!entries)
                 return -ENOMEM;
 
diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c
index 123f578d6dd3..4cfaaa5a49be 100644
--- a/drivers/dma/edma.c
+++ b/drivers/dma/edma.c
@@ -1107,52 +1107,14 @@ bool edma_filter_fn(struct dma_chan *chan, void *param)
 }
 EXPORT_SYMBOL(edma_filter_fn);
 
-static struct platform_device *pdev0, *pdev1;
-
-static const struct platform_device_info edma_dev_info0 = {
-        .name = "edma-dma-engine",
-        .id = 0,
-        .dma_mask = DMA_BIT_MASK(32),
-};
-
-static const struct platform_device_info edma_dev_info1 = {
-        .name = "edma-dma-engine",
-        .id = 1,
-        .dma_mask = DMA_BIT_MASK(32),
-};
-
 static int edma_init(void)
 {
-        int ret = platform_driver_register(&edma_driver);
-
-        if (ret == 0) {
-                pdev0 = platform_device_register_full(&edma_dev_info0);
-                if (IS_ERR(pdev0)) {
-                        platform_driver_unregister(&edma_driver);
-                        ret = PTR_ERR(pdev0);
-                        goto out;
-                }
-        }
-
-        if (!of_have_populated_dt() && EDMA_CTLRS == 2) {
-                pdev1 = platform_device_register_full(&edma_dev_info1);
-                if (IS_ERR(pdev1)) {
-                        platform_driver_unregister(&edma_driver);
-                        platform_device_unregister(pdev0);
-                        ret = PTR_ERR(pdev1);
-                }
-        }
-
-out:
-        return ret;
+        return platform_driver_register(&edma_driver);
 }
 subsys_initcall(edma_init);
 
 static void __exit edma_exit(void)
 {
-        platform_device_unregister(pdev0);
-        if (pdev1)
-                platform_device_unregister(pdev1);
         platform_driver_unregister(&edma_driver);
 }
 module_exit(edma_exit);
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 4839bfa74a10..19a99743cf52 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -271,7 +271,7 @@ struct pl330_config {
 #define DMAC_MODE_NS    (1 << 0)
         unsigned int    mode;
         unsigned int    data_bus_width:10; /* In number of bits */
-        unsigned int    data_buf_dep:10;
+        unsigned int    data_buf_dep:11;
         unsigned int    num_chan:4;
         unsigned int    num_peri:6;
         u32             peri_ns;
@@ -2336,7 +2336,7 @@ static inline int get_burst_len(struct dma_pl330_desc *desc, size_t len)
         int burst_len;
 
         burst_len = pl330->pcfg.data_bus_width / 8;
-        burst_len *= pl330->pcfg.data_buf_dep;
+        burst_len *= pl330->pcfg.data_buf_dep / pl330->pcfg.num_chan;
         burst_len >>= desc->rqcfg.brst_size;
 
         /* src/dst_burst_len can't be more than 16 */
@@ -2459,16 +2459,25 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
         /* Select max possible burst size */
         burst = pl330->pcfg.data_bus_width / 8;
 
-        while (burst > 1) {
-                if (!(len % burst))
-                        break;
+        /*
+         * Make sure we use a burst size that aligns with all the memcpy
+         * parameters because our DMA programming algorithm doesn't cope with
+         * transfers which straddle an entry in the DMA device's MFIFO.
+         */
+        while ((src | dst | len) & (burst - 1))
                 burst /= 2;
-        }
 
         desc->rqcfg.brst_size = 0;
         while (burst != (1 << desc->rqcfg.brst_size))
                 desc->rqcfg.brst_size++;
 
+        /*
+         * If burst size is smaller than bus width then make sure we only
+         * transfer one at a time to avoid a burst stradling an MFIFO entry.
+         */
+        if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
+                desc->rqcfg.brst_len = 1;
+
         desc->rqcfg.brst_len = get_burst_len(desc, len);
 
         desc->txd.flags = flags;
@@ -2732,7 +2741,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id)
 
 
         dev_info(&adev->dev,
-                "Loaded driver for PL330 DMAC-%d\n", adev->periphid);
+                "Loaded driver for PL330 DMAC-%x\n", adev->periphid);
         dev_info(&adev->dev,
                 "\tDBUFF-%ux%ubytes Num_Chans-%u Num_Peri-%u Num_Events-%u\n",
                 pcfg->data_buf_dep, pcfg->data_bus_width / 8, pcfg->num_chan,
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 3aa10b328254..91292f5513ff 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -230,30 +230,25 @@ static inline void sun6i_dma_dump_chan_regs(struct sun6i_dma_dev *sdev,
                 readl(pchan->base + DMA_CHAN_CUR_PARA));
 }
 
-static inline int convert_burst(u32 maxburst, u8 *burst)
+static inline s8 convert_burst(u32 maxburst)
 {
         switch (maxburst) {
         case 1:
-                *burst = 0;
-                break;
+                return 0;
         case 8:
-                *burst = 2;
-                break;
+                return 2;
         default:
                 return -EINVAL;
         }
-
-        return 0;
 }
 
-static inline int convert_buswidth(enum dma_slave_buswidth addr_width, u8 *width)
+static inline s8 convert_buswidth(enum dma_slave_buswidth addr_width)
 {
         if ((addr_width < DMA_SLAVE_BUSWIDTH_1_BYTE) ||
             (addr_width > DMA_SLAVE_BUSWIDTH_4_BYTES))
                 return -EINVAL;
 
-        *width = addr_width >> 1;
-        return 0;
+        return addr_width >> 1;
 }
 
 static void *sun6i_dma_lli_add(struct sun6i_dma_lli *prev,
@@ -284,26 +279,25 @@ static inline int sun6i_dma_cfg_lli(struct sun6i_dma_lli *lli,
                                     struct dma_slave_config *config)
 {
         u8 src_width, dst_width, src_burst, dst_burst;
-        int ret;
 
         if (!config)
                 return -EINVAL;
 
-        ret = convert_burst(config->src_maxburst, &src_burst);
-        if (ret)
-                return ret;
+        src_burst = convert_burst(config->src_maxburst);
+        if (src_burst)
+                return src_burst;
 
-        ret = convert_burst(config->dst_maxburst, &dst_burst);
-        if (ret)
-                return ret;
+        dst_burst = convert_burst(config->dst_maxburst);
+        if (dst_burst)
+                return dst_burst;
 
-        ret = convert_buswidth(config->src_addr_width, &src_width);
-        if (ret)
-                return ret;
+        src_width = convert_buswidth(config->src_addr_width);
+        if (src_width)
+                return src_width;
 
-        ret = convert_buswidth(config->dst_addr_width, &dst_width);
-        if (ret)
-                return ret;
+        dst_width = convert_buswidth(config->dst_addr_width);
+        if (dst_width)
+                return dst_width;
 
         lli->cfg = DMA_CHAN_CFG_SRC_BURST(src_burst) |
                 DMA_CHAN_CFG_SRC_WIDTH(src_width) |
@@ -542,11 +536,10 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 {
         struct sun6i_dma_dev *sdev = to_sun6i_dma_dev(chan->device);
         struct sun6i_vchan *vchan = to_sun6i_vchan(chan);
-        struct dma_slave_config *sconfig = &vchan->cfg;
         struct sun6i_dma_lli *v_lli;
         struct sun6i_desc *txd;
         dma_addr_t p_lli;
-        int ret;
+        s8 burst, width;
 
         dev_dbg(chan2dev(chan),
                 "%s; chan: %d, dest: %pad, src: %pad, len: %zu. flags: 0x%08lx\n",
@@ -565,14 +558,21 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
                 goto err_txd_free;
         }
 
-        ret = sun6i_dma_cfg_lli(v_lli, src, dest, len, sconfig);
-        if (ret)
-                goto err_dma_free;
+        v_lli->src = src;
+        v_lli->dst = dest;
+        v_lli->len = len;
+        v_lli->para = NORMAL_WAIT;
 
+        burst = convert_burst(8);
+        width = convert_buswidth(DMA_SLAVE_BUSWIDTH_4_BYTES);
         v_lli->cfg |= DMA_CHAN_CFG_SRC_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_DRQ(DRQ_SDRAM) |
                 DMA_CHAN_CFG_DST_LINEAR_MODE |
-                DMA_CHAN_CFG_SRC_LINEAR_MODE;
+                DMA_CHAN_CFG_SRC_LINEAR_MODE |
+                DMA_CHAN_CFG_SRC_BURST(burst) |
+                DMA_CHAN_CFG_SRC_WIDTH(width) |
+                DMA_CHAN_CFG_DST_BURST(burst) |
+                DMA_CHAN_CFG_DST_WIDTH(width);
 
         sun6i_dma_lli_add(NULL, v_lli, p_lli, txd);
 
@@ -580,8 +580,6 @@ static struct dma_async_tx_descriptor *sun6i_dma_prep_dma_memcpy(
 
         return vchan_tx_prep(&vchan->vc, &txd->vd, flags);
 
-err_dma_free:
-        dma_pool_free(sdev->pool, v_lli, p_lli);
 err_txd_free:
         kfree(txd);
         return NULL;
@@ -915,6 +913,7 @@ static int sun6i_dma_probe(struct platform_device *pdev)
         sdc->slave.device_prep_dma_memcpy       = sun6i_dma_prep_dma_memcpy;
         sdc->slave.device_control               = sun6i_dma_control;
         sdc->slave.chancnt                      = NR_MAX_VCHANS;
+        sdc->slave.copy_align                   = 4;
 
         sdc->slave.dev = &pdev->dev;
 
diff --git a/drivers/edac/cpc925_edac.c b/drivers/edac/cpc925_edac.c
index df6575f1430d..682288ced4ac 100644
--- a/drivers/edac/cpc925_edac.c
+++ b/drivers/edac/cpc925_edac.c
@@ -562,7 +562,7 @@ static void cpc925_mc_check(struct mem_ctl_info *mci)
 
         if (apiexcp & UECC_EXCP_DETECTED) {
                 cpc925_mc_printk(mci, KERN_INFO, "DRAM UECC Fault\n");
-                edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1,
+                edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1,
                                      pfn, offset, 0,
                                      csrow, -1, -1,
                                      mci->ctl_name, "");
diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
index 3cda79bc8b00..ece3aef16bb1 100644
--- a/drivers/edac/e7xxx_edac.c
+++ b/drivers/edac/e7xxx_edac.c
@@ -226,7 +226,7 @@ static void process_ce(struct mem_ctl_info *mci, struct e7xxx_error_info *info)
 static void process_ce_no_info(struct mem_ctl_info *mci)
 {
         edac_dbg(3, "\n");
-        edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1, 0, 0, 0, -1, -1, -1,
+        edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1, 0, 0, 0, -1, -1, -1,
                              "e7xxx CE log register overflow", "");
 }
 
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index 022a70273ada..aa98b136f5d0 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -242,11 +242,11 @@ static void i3200_process_error_info(struct mem_ctl_info *mci,
                                              -1, -1,
                                              "i3000 UE", "");
                 } else if (log & I3200_ECCERRLOG_CE) {
-                        edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1,
+                        edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1,
                                              0, 0, eccerrlog_syndrome(log),
                                              eccerrlog_row(channel, log),
                                              -1, -1,
-                                             "i3000 UE", "");
+                                             "i3000 CE", "");
                 }
         }
 }
diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
index 3382f6344e42..4382343a7c60 100644
--- a/drivers/edac/i82860_edac.c
+++ b/drivers/edac/i82860_edac.c
@@ -124,7 +124,7 @@ static int i82860_process_error_info(struct mem_ctl_info *mci,
                                      dimm->location[0], dimm->location[1], -1,
                                      "i82860 UE", "");
         else
-                edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci, 1,
+                edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci, 1,
                                      info->eap, 0, info->derrsyn,
                                      dimm->location[0], dimm->location[1], -1,
                                      "i82860 CE", "");
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 5d997a33907e..2a3973a7c441 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -1637,8 +1637,7 @@ static int dispatch_ioctl(struct client *client,
             _IOC_SIZE(cmd) > sizeof(buffer))
                 return -ENOTTY;
 
-        if (_IOC_DIR(cmd) == _IOC_READ)
-                memset(&buffer, 0, _IOC_SIZE(cmd));
+        memset(&buffer, 0, sizeof(buffer));
 
         if (_IOC_DIR(cmd) & _IOC_WRITE)
                 if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
index 9a0cc09e6653..e4a1490b42c2 100644
--- a/drivers/gpu/drm/armada/armada_crtc.c
+++ b/drivers/gpu/drm/armada/armada_crtc.c
@@ -260,7 +260,7 @@ static void armada_drm_vblank_off(struct armada_crtc *dcrtc)
          * Tell the DRM core that vblank IRQs aren't going to happen for
          * a while.  This cleans up any pending vblank events for us.
          */
-        drm_vblank_off(dev, dcrtc->num);
+        drm_crtc_vblank_off(&dcrtc->crtc);
 
         /* Handle any pending flip event. */
         spin_lock_irq(&dev->event_lock);
@@ -289,6 +289,8 @@ static void armada_drm_crtc_dpms(struct drm_crtc *crtc, int dpms)
                 armada_drm_crtc_update(dcrtc);
                 if (dpms_blanked(dpms))
                         armada_drm_vblank_off(dcrtc);
+                else
+                        drm_crtc_vblank_on(&dcrtc->crtc);
         }
 }
 
@@ -526,7 +528,7 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
         /* Wait for pending flips to complete */
         wait_event(dcrtc->frame_wait, !dcrtc->frame_work);
 
-        drm_vblank_pre_modeset(crtc->dev, dcrtc->num);
+        drm_crtc_vblank_off(crtc);
 
         crtc->mode = *adj;
 
@@ -617,7 +619,7 @@ static int armada_drm_crtc_mode_set(struct drm_crtc *crtc,
 
         armada_drm_crtc_update(dcrtc);
 
-        drm_vblank_post_modeset(crtc->dev, dcrtc->num);
+        drm_crtc_vblank_on(crtc);
         armada_drm_crtc_finish_fb(dcrtc, old_fb, dpms_blanked(dcrtc->dpms));
 
         return 0;
@@ -945,18 +947,15 @@ static int armada_drm_crtc_page_flip(struct drm_crtc *crtc,
         armada_reg_queue_end(work->regs, i);
 
         /*
-         * Hold the old framebuffer for the work - DRM appears to drop our
-         * reference to the old framebuffer in drm_mode_page_flip_ioctl().
+         * Ensure that we hold a reference on the new framebuffer.
+         * This has to match the behaviour in mode_set.
          */
-        drm_framebuffer_reference(work->old_fb);
+        drm_framebuffer_reference(fb);
 
         ret = armada_drm_crtc_queue_frame_work(dcrtc, work);
         if (ret) {
-                /*
-                 * Undo our reference above; DRM does not drop the reference
-                 * to this object on error, so that's okay.
-                 */
-                drm_framebuffer_unreference(work->old_fb);
+                /* Undo our reference above */
+                drm_framebuffer_unreference(fb);
                 kfree(work);
                 return ret;
         }
diff --git a/drivers/gpu/drm/armada/armada_drv.c b/drivers/gpu/drm/armada/armada_drv.c
index f672e6ad8afa..908e5316eac4 100644
--- a/drivers/gpu/drm/armada/armada_drv.c
+++ b/drivers/gpu/drm/armada/armada_drv.c
@@ -190,6 +190,7 @@ static int armada_drm_load(struct drm_device *dev, unsigned long flags)
         if (ret)
                 goto err_comp;
 
+        dev->irq_enabled = true;
         dev->vblank_disable_allowed = 1;
 
         ret = armada_fbdev_init(dev);
@@ -331,7 +332,7 @@ static struct drm_driver armada_drm_driver = {
         .desc                   = "Armada SoC DRM",
         .date                   = "20120730",
         .driver_features        = DRIVER_GEM | DRIVER_MODESET |
-                                  DRIVER_PRIME,
+                                  DRIVER_HAVE_IRQ | DRIVER_PRIME,
         .ioctls                 = armada_ioctls,
         .fops                   = &armada_drm_fops,
 };
diff --git a/drivers/gpu/drm/exynos/exynos_dp_core.c b/drivers/gpu/drm/exynos/exynos_dp_core.c
index cd50ece31601..6adb1e5cfb08 100644
--- a/drivers/gpu/drm/exynos/exynos_dp_core.c
+++ b/drivers/gpu/drm/exynos/exynos_dp_core.c
@@ -1355,13 +1355,8 @@ static void exynos_dp_unbind(struct device *dev, struct device *master,
                                 void *data)
 {
         struct exynos_drm_display *display = dev_get_drvdata(dev);
-        struct exynos_dp_device *dp = display->ctx;
-        struct drm_encoder *encoder = dp->encoder;
 
         exynos_dp_dpms(display, DRM_MODE_DPMS_OFF);
-
-        exynos_dp_connector_destroy(&dp->connector);
-        encoder->funcs->destroy(encoder);
 }
 
 static const struct component_ops exynos_dp_ops = {
diff --git a/drivers/gpu/drm/exynos/exynos_drm_crtc.c b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
index 8e38e9f8e542..45026e693225 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_crtc.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_crtc.c
@@ -71,13 +71,16 @@ static void exynos_drm_crtc_dpms(struct drm_crtc *crtc, int mode)
                                 !atomic_read(&exynos_crtc->pending_flip),
                                 HZ/20))
                         atomic_set(&exynos_crtc->pending_flip, 0);
-                drm_vblank_off(crtc->dev, exynos_crtc->pipe);
+                drm_crtc_vblank_off(crtc);
         }
 
         if (manager->ops->dpms)
                 manager->ops->dpms(manager, mode);
 
         exynos_crtc->dpms = mode;
+
+        if (mode == DRM_MODE_DPMS_ON)
+                drm_crtc_vblank_on(crtc);
 }
 
 static void exynos_drm_crtc_prepare(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dpi.c b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
index 96c87db388fb..3dc678ed9949 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dpi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dpi.c
@@ -338,14 +338,10 @@ err_del_component:
 
 int exynos_dpi_remove(struct device *dev)
 {
-        struct drm_encoder *encoder = exynos_dpi_display.encoder;
         struct exynos_dpi *ctx = exynos_dpi_display.ctx;
 
         exynos_dpi_dpms(&exynos_dpi_display, DRM_MODE_DPMS_OFF);
 
-        exynos_dpi_connector_destroy(&ctx->connector);
-        encoder->funcs->destroy(encoder);
-
         if (ctx->panel)
                 drm_panel_detach(ctx->panel);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.c b/drivers/gpu/drm/exynos/exynos_drm_drv.c
index 443a2069858a..e5c4c6c8c967 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.c
@@ -87,16 +87,12 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
 
                 plane = exynos_plane_init(dev, possible_crtcs,
                                           DRM_PLANE_TYPE_OVERLAY);
-                if (IS_ERR(plane))
-                        goto err_mode_config_cleanup;
-        }
-
-        /* init kms poll for handling hpd */
-        drm_kms_helper_poll_init(dev);
+                if (!IS_ERR(plane))
+                        continue;
 
-        ret = drm_vblank_init(dev, MAX_CRTC);
-        if (ret)
+                ret = PTR_ERR(plane);
                 goto err_mode_config_cleanup;
+        }
 
         /* setup possible_clones. */
         exynos_drm_encoder_setup(dev);
@@ -106,15 +102,16 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
         /* Try to bind all sub drivers. */
         ret = component_bind_all(dev->dev, dev);
         if (ret)
-                goto err_cleanup_vblank;
+                goto err_mode_config_cleanup;
 
-        /* Probe non kms sub drivers and virtual display driver. */
-        ret = exynos_drm_device_subdrv_probe(dev);
+        ret = drm_vblank_init(dev, dev->mode_config.num_crtc);
         if (ret)
                 goto err_unbind_all;
 
-        /* force connectors detection */
-        drm_helper_hpd_irq_event(dev);
+        /* Probe non kms sub drivers and virtual display driver. */
+        ret = exynos_drm_device_subdrv_probe(dev);
+        if (ret)
+                goto err_cleanup_vblank;
 
         /*
          * enable drm irq mode.
@@ -133,12 +130,18 @@ static int exynos_drm_load(struct drm_device *dev, unsigned long flags)
          */
         dev->vblank_disable_allowed = true;
 
+        /* init kms poll for handling hpd */
+        drm_kms_helper_poll_init(dev);
+
+        /* force connectors detection */
+        drm_helper_hpd_irq_event(dev);
+
         return 0;
 
-err_unbind_all:
-        component_unbind_all(dev->dev, dev);
 err_cleanup_vblank:
         drm_vblank_cleanup(dev);
+err_unbind_all:
+        component_unbind_all(dev->dev, dev);
 err_mode_config_cleanup:
         drm_mode_config_cleanup(dev);
         drm_release_iommu_mapping(dev);
@@ -155,8 +158,8 @@ static int exynos_drm_unload(struct drm_device *dev)
         exynos_drm_fbdev_fini(dev);
         drm_kms_helper_poll_fini(dev);
 
-        component_unbind_all(dev->dev, dev);
         drm_vblank_cleanup(dev);
+        component_unbind_all(dev->dev, dev);
         drm_mode_config_cleanup(dev);
         drm_release_iommu_mapping(dev);
 
@@ -191,8 +194,12 @@ static int exynos_drm_resume(struct drm_device *dev)
 
         drm_modeset_lock_all(dev);
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                if (connector->funcs->dpms)
-                        connector->funcs->dpms(connector, connector->dpms);
+                if (connector->funcs->dpms) {
+                        int dpms = connector->dpms;
+
+                        connector->dpms = DRM_MODE_DPMS_OFF;
+                        connector->funcs->dpms(connector, dpms);
+                }
         }
         drm_modeset_unlock_all(dev);
 
@@ -488,6 +495,12 @@ static struct component_match *exynos_drm_match_add(struct device *dev)
 
         mutex_lock(&drm_component_lock);
 
+        /* Do not retry to probe if there is no any kms driver regitered. */
+        if (list_empty(&drm_component_list)) {
+                mutex_unlock(&drm_component_lock);
+                return ERR_PTR(-ENODEV);
+        }
+
         list_for_each_entry(cdev, &drm_component_list, list) {
                 /*
                  * Add components to master only in case that crtc and
@@ -578,10 +591,21 @@ static int exynos_drm_platform_probe(struct platform_device *pdev)
                 goto err_unregister_mixer_drv;
 #endif
 
+        match = exynos_drm_match_add(&pdev->dev);
+        if (IS_ERR(match)) {
+                ret = PTR_ERR(match);
+                goto err_unregister_hdmi_drv;
+        }
+
+        ret = component_master_add_with_match(&pdev->dev, &exynos_drm_ops,
+                                                match);
+        if (ret < 0)
+                goto err_unregister_hdmi_drv;
+
 #ifdef CONFIG_DRM_EXYNOS_G2D
         ret = platform_driver_register(&g2d_driver);
         if (ret < 0)
-                goto err_unregister_hdmi_drv;
+                goto err_del_component_master;
 #endif
 
 #ifdef CONFIG_DRM_EXYNOS_FIMC
@@ -612,23 +636,9 @@ static int exynos_drm_platform_probe(struct platform_device *pdev)
                 goto err_unregister_ipp_drv;
 #endif
 
-        match = exynos_drm_match_add(&pdev->dev);
-        if (IS_ERR(match)) {
-                ret = PTR_ERR(match);
-                goto err_unregister_resources;
-        }
-
-        ret = component_master_add_with_match(&pdev->dev, &exynos_drm_ops,
-                                                match);
-        if (ret < 0)
-                goto err_unregister_resources;
-
         return ret;
 
-err_unregister_resources:
-
 #ifdef CONFIG_DRM_EXYNOS_IPP
-        exynos_platform_device_ipp_unregister();
 err_unregister_ipp_drv:
         platform_driver_unregister(&ipp_driver);
 err_unregister_gsc_drv:
@@ -651,9 +661,11 @@ err_unregister_g2d_drv:
 
 #ifdef CONFIG_DRM_EXYNOS_G2D
         platform_driver_unregister(&g2d_driver);
-err_unregister_hdmi_drv:
+err_del_component_master:
 #endif
+        component_master_del(&pdev->dev, &exynos_drm_ops);
 
+err_unregister_hdmi_drv:
 #ifdef CONFIG_DRM_EXYNOS_HDMI
         platform_driver_unregister(&hdmi_driver);
 err_unregister_mixer_drv:
@@ -734,6 +746,18 @@ static int exynos_drm_init(void)
 {
         int ret;
 
+        /*
+         * Register device object only in case of Exynos SoC.
+         *
+         * Below codes resolves temporarily infinite loop issue incurred
+         * by Exynos drm driver when using multi-platform kernel.
+         * So these codes will be replaced with more generic way later.
+         */
+        if (!of_machine_is_compatible("samsung,exynos3") &&
+                        !of_machine_is_compatible("samsung,exynos4") &&
+                        !of_machine_is_compatible("samsung,exynos5"))
+                return -ENODEV;
+
         exynos_drm_pdev = platform_device_register_simple("exynos-drm", -1,
                                                                 NULL, 0);
         if (IS_ERR(exynos_drm_pdev))
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
index 24741d8758e8..acf7e9e39dcd 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c
@@ -1660,13 +1660,9 @@ static void exynos_dsi_unbind(struct device *dev, struct device *master,
                                 void *data)
 {
         struct exynos_dsi *dsi = exynos_dsi_display.ctx;
-        struct drm_encoder *encoder = dsi->encoder;
 
         exynos_dsi_dpms(&exynos_dsi_display, DRM_MODE_DPMS_OFF);
 
-        exynos_dsi_connector_destroy(&dsi->connector);
-        encoder->funcs->destroy(encoder);
-
         mipi_dsi_host_unregister(&dsi->dsi_host);
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index df7a77d3eff8..6ff8599f6cbf 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -302,9 +302,12 @@ static void g2d_fini_cmdlist(struct g2d_data *g2d)
         struct exynos_drm_subdrv *subdrv = &g2d->subdrv;
 
         kfree(g2d->cmdlist_node);
-        dma_free_attrs(subdrv->drm_dev->dev, G2D_CMDLIST_POOL_SIZE,
-                        g2d->cmdlist_pool_virt,
-                        g2d->cmdlist_pool, &g2d->cmdlist_dma_attrs);
+
+        if (g2d->cmdlist_pool_virt && g2d->cmdlist_pool) {
+                dma_free_attrs(subdrv->drm_dev->dev, G2D_CMDLIST_POOL_SIZE,
+                                g2d->cmdlist_pool_virt,
+                                g2d->cmdlist_pool, &g2d->cmdlist_dma_attrs);
+        }
 }
 
 static struct g2d_cmdlist_node *g2d_get_cmdlist(struct g2d_data *g2d)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index d565207040a2..50faf913e574 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -630,7 +630,6 @@ static int vidi_remove(struct platform_device *pdev)
 {
         struct exynos_drm_manager *mgr = platform_get_drvdata(pdev);
         struct vidi_context *ctx = mgr->ctx;
-        struct drm_encoder *encoder = ctx->encoder;
 
         if (ctx->raw_edid != (struct edid *)fake_edid_info) {
                 kfree(ctx->raw_edid);
@@ -639,9 +638,6 @@ static int vidi_remove(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        encoder->funcs->destroy(encoder);
-        drm_connector_cleanup(&ctx->connector);
-
         return 0;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 7910fb37d9bb..563a19e62eb2 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -2312,12 +2312,6 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
 
 static void hdmi_unbind(struct device *dev, struct device *master, void *data)
 {
-        struct exynos_drm_display *display = get_hdmi_display(dev);
-        struct drm_encoder *encoder = display->encoder;
-        struct hdmi_context *hdata = display->ctx;
-
-        hdmi_connector_destroy(&hdata->connector);
-        encoder->funcs->destroy(encoder);
 }
 
 static const struct component_ops hdmi_component_ops = {
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 1403b01e8216..318ade9bb5af 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1670,15 +1670,17 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto out_regs;
 
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                ret = i915_kick_out_vgacon(dev_priv);
+                /* WARNING: Apparently we must kick fbdev drivers before vgacon,
+                 * otherwise the vga fbdev driver falls over. */
+                ret = i915_kick_out_firmware_fb(dev_priv);
                 if (ret) {
-                        DRM_ERROR("failed to remove conflicting VGA console\n");
+                        DRM_ERROR("failed to remove conflicting framebuffer drivers\n");
                         goto out_gtt;
                 }
 
-                ret = i915_kick_out_firmware_fb(dev_priv);
+                ret = i915_kick_out_vgacon(dev_priv);
                 if (ret) {
-                        DRM_ERROR("failed to remove conflicting framebuffer drivers\n");
+                        DRM_ERROR("failed to remove conflicting VGA console\n");
                         goto out_gtt;
                 }
         }
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 055d5e7fbf12..2318b4c7a8f8 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -986,6 +986,15 @@ static int i915_pm_freeze(struct device *dev)
         return i915_drm_freeze(drm_dev);
 }
 
+static int i915_pm_freeze_late(struct device *dev)
+{
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        struct drm_i915_private *dev_priv = drm_dev->dev_private;
+
+        return intel_suspend_complete(dev_priv);
+}
+
 static int i915_pm_thaw_early(struct device *dev)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -1570,6 +1579,7 @@ static const struct dev_pm_ops i915_pm_ops = {
         .resume_early = i915_pm_resume_early,
         .resume = i915_pm_resume,
         .freeze = i915_pm_freeze,
+        .freeze_late = i915_pm_freeze_late,
         .thaw_early = i915_pm_thaw_early,
         .thaw = i915_pm_thaw,
         .poweroff = i915_pm_poweroff,
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index b672b843fd5e..728938f02341 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -1902,6 +1902,22 @@ static void bdw_setup_private_ppat(struct drm_i915_private *dev_priv)
               GEN8_PPAT(6, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(2)) |
               GEN8_PPAT(7, GEN8_PPAT_WB | GEN8_PPAT_LLCELLC | GEN8_PPAT_AGE(3));
 
+        if (!USES_PPGTT(dev_priv->dev))
+                /* Spec: "For GGTT, there is NO pat_sel[2:0] from the entry,
+                 * so RTL will always use the value corresponding to
+                 * pat_sel = 000".
+                 * So let's disable cache for GGTT to avoid screen corruptions.
+                 * MOCS still can be used though.
+                 * - System agent ggtt writes (i.e. cpu gtt mmaps) already work
+                 * before this patch, i.e. the same uncached + snooping access
+                 * like on gen6/7 seems to be in effect.
+                 * - So this just fixes blitter/render access. Again it looks
+                 * like it's not just uncached access, but uncached + snooping.
+                 * So we can still hold onto all our assumptions wrt cpu
+                 * clflushing on LLC machines.
+                 */
+                pat = GEN8_PPAT(0, GEN8_PPAT_UC);
+
         /* XXX: spec defines this as 2 distinct registers. It's unclear if a 64b
          * write would work. */
         I915_WRITE(GEN8_PRIVATE_PAT, pat);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 2cefb597df6d..2b1eaa29ada4 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -364,22 +364,9 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                  * has to also include the unfenced register the GPU uses
                  * whilst executing a fenced command for an untiled object.
                  */
-
-                obj->map_and_fenceable =
-                        !i915_gem_obj_ggtt_bound(obj) ||
-                        (i915_gem_obj_ggtt_offset(obj) +
-                         obj->base.size <= dev_priv->gtt.mappable_end &&
-                         i915_gem_object_fence_ok(obj, args->tiling_mode));
-
-                /* Rebind if we need a change of alignment */
-                if (!obj->map_and_fenceable) {
-                        u32 unfenced_align =
-                                i915_gem_get_gtt_alignment(dev, obj->base.size,
-                                                            args->tiling_mode,
-                                                            false);
-                        if (i915_gem_obj_ggtt_offset(obj) & (unfenced_align - 1))
-                                ret = i915_gem_object_ggtt_unbind(obj);
-                }
+                if (obj->map_and_fenceable &&
+                    !i915_gem_object_fence_ok(obj, args->tiling_mode))
+                        ret = i915_gem_object_ggtt_unbind(obj);
 
                 if (ret == 0) {
                         obj->fence_dirty =
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index c9e220963a78..f0a1a56406eb 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4585,7 +4585,7 @@ static void vlv_update_cdclk(struct drm_device *dev)
          * BSpec erroneously claims we should aim for 4MHz, but
          * in fact 1MHz is the correct frequency.
          */
-        I915_WRITE(GMBUSFREQ_VLV, dev_priv->vlv_cdclk_freq);
+        I915_WRITE(GMBUSFREQ_VLV, DIV_ROUND_UP(dev_priv->vlv_cdclk_freq, 1000));
 }
 
 /* Adjust CDclk dividers to allow high res or save power if possible */
@@ -12885,6 +12885,9 @@ static struct intel_quirk intel_quirks[] = {
         /* Acer C720 Chromebook (Core i3 4005U) */
         { 0x0a16, 0x1025, 0x0a11, quirk_backlight_present },
 
+        /* Apple Macbook 2,1 (Core 2 T7400) */
+        { 0x27a2, 0x8086, 0x7270, quirk_backlight_present },
+
         /* Toshiba CB35 Chromebook (Celeron 2955U) */
         { 0x0a06, 0x1179, 0x0a88, quirk_backlight_present },
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index f6a3fdd5589e..5ad45bfff3fe 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2806,6 +2806,13 @@ intel_dp_dpcd_read_wake(struct drm_dp_aux *aux, unsigned int offset,
         ssize_t ret;
         int i;
 
+        /*
+         * Sometime we just get the same incorrect byte repeated
+         * over the entire buffer. Doing just one throw away read
+         * initially seems to "solve" it.
+         */
+        drm_dp_dpcd_read(aux, DP_DPCD_REV, buffer, 1);
+
         for (i = 0; i < 3; i++) {
                 ret = drm_dp_dpcd_read(aux, offset, buffer, size);
                 if (ret == size)
@@ -3724,9 +3731,10 @@ intel_dp_get_dpcd(struct intel_dp *intel_dp)
                 }
         }
 
-        /* Training Pattern 3 support */
+        /* Training Pattern 3 support, both source and sink */
         if (intel_dp->dpcd[DP_DPCD_REV] >= 0x12 &&
-            intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED) {
+            intel_dp->dpcd[DP_MAX_LANE_COUNT] & DP_TPS3_SUPPORTED &&
+            (IS_HASWELL(dev_priv) || INTEL_INFO(dev_priv)->gen >= 8)) {
                 intel_dp->use_tps3 = true;
                 DRM_DEBUG_KMS("Displayport TPS3 supported\n");
         } else
@@ -4491,6 +4499,18 @@ intel_dp_hpd_pulse(struct intel_digital_port *intel_dig_port, bool long_hpd)
         if (intel_dig_port->base.type != INTEL_OUTPUT_EDP)
                 intel_dig_port->base.type = INTEL_OUTPUT_DISPLAYPORT;
 
+        if (long_hpd && intel_dig_port->base.type == INTEL_OUTPUT_EDP) {
+                /*
+                 * vdd off can generate a long pulse on eDP which
+                 * would require vdd on to handle it, and thus we
+                 * would end up in an endless cycle of
+                 * "vdd off -> long hpd -> vdd on -> detect -> vdd off -> ..."
+                 */
+                DRM_DEBUG_KMS("ignoring long hpd on eDP port %c\n",
+                              port_name(intel_dig_port->port));
+                return false;
+        }
+
         DRM_DEBUG_KMS("got hpd irq on port %c - %s\n",
                       port_name(intel_dig_port->port),
                       long_hpd ? "long" : "short");
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index 0e018cb49147..41b3be217493 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -1098,12 +1098,25 @@ static u32 get_backlight_min_vbt(struct intel_connector *connector)
         struct drm_device *dev = connector->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_panel *panel = &connector->panel;
+        int min;
 
         WARN_ON(panel->backlight.max == 0);
 
+        /*
+         * XXX: If the vbt value is 255, it makes min equal to max, which leads
+         * to problems. There are such machines out there. Either our
+         * interpretation is wrong or the vbt has bogus data. Or both. Safeguard
+         * against this by letting the minimum be at most (arbitrarily chosen)
+         * 25% of the max.
+         */
+        min = clamp_t(int, dev_priv->vbt.backlight.min_brightness, 0, 64);
+        if (min != dev_priv->vbt.backlight.min_brightness) {
+                DRM_DEBUG_KMS("clamping VBT min backlight %d/255 to %d/255\n",
+                              dev_priv->vbt.backlight.min_brightness, min);
+        }
+
         /* vbt value is a coefficient in range [0..255] */
-        return scale(dev_priv->vbt.backlight.min_brightness, 0, 255,
-                     0, panel->backlight.max);
+        return scale(min, 0, 255, 0, panel->backlight.max);
 }
 
 static int bdw_setup_backlight(struct intel_connector *connector)
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index c27b6140bfd1..ad2fd605f76b 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5469,11 +5469,6 @@ static void gen6_init_clock_gating(struct drm_device *dev)
         I915_WRITE(_3D_CHICKEN,
                    _MASKED_BIT_ENABLE(_3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB));
 
-        /* WaSetupGtModeTdRowDispatch:snb */
-        if (IS_SNB_GT1(dev))
-                I915_WRITE(GEN6_GT_MODE,
-                           _MASKED_BIT_ENABLE(GEN6_TD_FOUR_ROW_DISPATCH_DISABLE));
-
         /* WaDisable_RenderCache_OperationalFlush:snb */
         I915_WRITE(CACHE_MODE_0, _MASKED_BIT_DISABLE(RC_OP_FLUSH_ENABLE));
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c b/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
index a16024a74771..fde42e4d1b56 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/gk20a.c
@@ -27,6 +27,20 @@ struct gk20a_fb_priv {
 };
 
 static int
+gk20a_fb_init(struct nouveau_object *object)
+{
+        struct gk20a_fb_priv *priv = (void *)object;
+        int ret;
+
+        ret = nouveau_fb_init(&priv->base);
+        if (ret)
+                return ret;
+
+        nv_mask(priv, 0x100c80, 0x00000001, 0x00000000); /* 128KiB lpg */
+        return 0;
+}
+
+static int
 gk20a_fb_ctor(struct nouveau_object *parent, struct nouveau_object *engine,
              struct nouveau_oclass *oclass, void *data, u32 size,
              struct nouveau_object **pobject)
@@ -48,7 +62,7 @@ gk20a_fb_oclass = &(struct nouveau_fb_impl) {
         .base.ofuncs = &(struct nouveau_ofuncs) {
                 .ctor = gk20a_fb_ctor,
                 .dtor = _nouveau_fb_dtor,
-                .init = _nouveau_fb_init,
+                .init = gk20a_fb_init,
                 .fini = _nouveau_fb_fini,
         },
         .memtype = nvc0_fb_memtype_valid,
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index ae873d1a8d46..eb8b36714fa1 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -791,6 +791,22 @@ nv50_crtc_set_scale(struct nouveau_crtc *nv_crtc, bool update)
 }
 
 static int
+nv50_crtc_set_raster_vblank_dmi(struct nouveau_crtc *nv_crtc, u32 usec)
+{
+        struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
+        u32 *push;
+
+        push = evo_wait(mast, 8);
+        if (!push)
+                return -ENOMEM;
+
+        evo_mthd(push, 0x0828 + (nv_crtc->index * 0x400), 1);
+        evo_data(push, usec);
+        evo_kick(push, mast);
+        return 0;
+}
+
+static int
 nv50_crtc_set_color_vibrance(struct nouveau_crtc *nv_crtc, bool update)
 {
         struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
@@ -1104,14 +1120,14 @@ nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *umode,
                         evo_mthd(push, 0x0804 + (nv_crtc->index * 0x400), 2);
                         evo_data(push, 0x00800000 | mode->clock);
                         evo_data(push, (ilace == 2) ? 2 : 0);
-                        evo_mthd(push, 0x0810 + (nv_crtc->index * 0x400), 8);
+                        evo_mthd(push, 0x0810 + (nv_crtc->index * 0x400), 6);
                         evo_data(push, 0x00000000);
                         evo_data(push, (vactive << 16) | hactive);
                         evo_data(push, ( vsynce << 16) | hsynce);
                         evo_data(push, (vblanke << 16) | hblanke);
                         evo_data(push, (vblanks << 16) | hblanks);
                         evo_data(push, (vblan2e << 16) | vblan2s);
-                        evo_data(push, vblankus);
+                        evo_mthd(push, 0x082c + (nv_crtc->index * 0x400), 1);
                         evo_data(push, 0x00000000);
                         evo_mthd(push, 0x0900 + (nv_crtc->index * 0x400), 2);
                         evo_data(push, 0x00000311);
@@ -1141,6 +1157,11 @@ nv50_crtc_mode_set(struct drm_crtc *crtc, struct drm_display_mode *umode,
         nv_connector = nouveau_crtc_connector_get(nv_crtc);
         nv50_crtc_set_dither(nv_crtc, false);
         nv50_crtc_set_scale(nv_crtc, false);
+
+        /* G94 only accepts this after setting scale */
+        if (nv50_vers(mast) < GF110_DISP_CORE_CHANNEL_DMA)
+                nv50_crtc_set_raster_vblank_dmi(nv_crtc, vblankus);
+
         nv50_crtc_set_color_vibrance(nv_crtc, false);
         nv50_crtc_set_image(nv_crtc, crtc->primary->fb, x, y, false);
         return 0;
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index 15da7ef344a4..ec1593a6a561 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -1217,7 +1217,7 @@ free:
         return ret;
 }
 
-int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+int atom_execute_table_scratch_unlocked(struct atom_context *ctx, int index, uint32_t * params)
 {
         int r;
 
@@ -1238,6 +1238,15 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
         return r;
 }
 
+int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+{
+        int r;
+        mutex_lock(&ctx->scratch_mutex);
+        r = atom_execute_table_scratch_unlocked(ctx, index, params);
+        mutex_unlock(&ctx->scratch_mutex);
+        return r;
+}
+
 static int atom_iio_len[] = { 1, 2, 3, 3, 3, 3, 4, 4, 4, 3 };
 
 static void atom_index_iio(struct atom_context *ctx, int base)
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index feba6b8d36b3..6d014ddb6b78 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -125,6 +125,7 @@ struct card_info {
 struct atom_context {
         struct card_info *card;
         struct mutex mutex;
+        struct mutex scratch_mutex;
         void *bios;
         uint32_t cmd_table, data_table;
         uint16_t *iio;
@@ -145,6 +146,7 @@ extern int atom_debug;
 
 struct atom_context *atom_parse(struct card_info *, void *);
 int atom_execute_table(struct atom_context *, int, uint32_t *);
+int atom_execute_table_scratch_unlocked(struct atom_context *, int, uint32_t *);
 int atom_asic_init(struct atom_context *);
 void atom_destroy(struct atom_context *);
 bool atom_parse_data_header(struct atom_context *ctx, int index, uint16_t *size,
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 95d5d4ab3335..11ba9d21b89b 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -100,6 +100,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
         memset(&args, 0, sizeof(args));
 
         mutex_lock(&chan->mutex);
+        mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
 
         base = (unsigned char *)(rdev->mode_info.atom_context->scratch + 1);
 
@@ -113,7 +114,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
         if (ASIC_IS_DCE4(rdev))
                 args.v2.ucHPD_ID = chan->rec.hpd;
 
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         *ack = args.v1.ucReplyStatus;
 
@@ -147,6 +148,7 @@ static int radeon_process_aux_ch(struct radeon_i2c_chan *chan,
 
         r = recv_bytes;
 done:
+        mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
         mutex_unlock(&chan->mutex);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/atombios_i2c.c b/drivers/gpu/drm/radeon/atombios_i2c.c
index 9c570fb15b8c..4157780585a0 100644
--- a/drivers/gpu/drm/radeon/atombios_i2c.c
+++ b/drivers/gpu/drm/radeon/atombios_i2c.c
@@ -48,6 +48,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         memset(&args, 0, sizeof(args));
 
         mutex_lock(&chan->mutex);
+        mutex_lock(&rdev->mode_info.atom_context->scratch_mutex);
 
         base = (unsigned char *)rdev->mode_info.atom_context->scratch;
 
@@ -82,7 +83,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
         args.ucSlaveAddr = slave_addr << 1;
         args.ucLineNumber = chan->rec.i2c_id;
 
-        atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
+        atom_execute_table_scratch_unlocked(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
         /* error */
         if (args.ucStatus != HW_ASSISTED_I2C_STATUS_SUCCESS) {
@@ -95,6 +96,7 @@ static int radeon_process_i2c_ch(struct radeon_i2c_chan *chan,
                 radeon_atom_copy_swap(buf, base, num, false);
 
 done:
+        mutex_unlock(&rdev->mode_info.atom_context->scratch_mutex);
         mutex_unlock(&chan->mutex);
 
         return r;
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 377afa504d2b..89c01fa6dd8e 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -4313,8 +4313,8 @@ static int cik_cp_gfx_start(struct radeon_device *rdev)
         /* init the CE partitions.  CE only used for gfx on CIK */
         radeon_ring_write(ring, PACKET3(PACKET3_SET_BASE, 2));
         radeon_ring_write(ring, PACKET3_BASE_INDEX(CE_PARTITION_BASE));
-        radeon_ring_write(ring, 0xc000);
-        radeon_ring_write(ring, 0xc000);
+        radeon_ring_write(ring, 0x8000);
+        radeon_ring_write(ring, 0x8000);
 
         /* setup clear context state */
         radeon_ring_write(ring, PACKET3(PACKET3_PREAMBLE_CNTL, 0));
@@ -9447,6 +9447,9 @@ void dce8_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
index 4e8432d07f15..d748963af08b 100644
--- a/drivers/gpu/drm/radeon/cik_sdma.c
+++ b/drivers/gpu/drm/radeon/cik_sdma.c
@@ -667,17 +667,20 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
 {
         struct radeon_ib ib;
         unsigned i;
+        unsigned index;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
         u32 tmp = 0;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
+
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        rdev->wb.wb[index/4] = cpu_to_le32(tmp);
 
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
@@ -686,8 +689,8 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
 
         ib.ptr[0] = SDMA_PACKET(SDMA_OPCODE_WRITE, SDMA_WRITE_SUB_OPCODE_LINEAR, 0);
-        ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
-        ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr);
+        ib.ptr[1] = lower_32_bits(gpu_addr);
+        ib.ptr[2] = upper_32_bits(gpu_addr);
         ib.ptr[3] = 1;
         ib.ptr[4] = 0xDEADBEEF;
         ib.length_dw = 5;
@@ -704,7 +707,7 @@ int cik_sdma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index a31f1ca40c6a..85995b4e3338 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2345,6 +2345,9 @@ void evergreen_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
@@ -2552,6 +2555,7 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                                         WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
                                         WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
@@ -3005,7 +3009,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         u32 vgt_cache_invalidation;
         u32 hdp_host_path_cntl, tmp;
         u32 disabled_rb_mask;
-        int i, j, num_shader_engines, ps_thread_count;
+        int i, j, ps_thread_count;
 
         switch (rdev->family) {
         case CHIP_CYPRESS:
@@ -3303,8 +3307,6 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         rdev->config.evergreen.tile_config |=
                 ((gb_addr_config & 0x30000000) >> 28) << 12;
 
-        num_shader_engines = (gb_addr_config & NUM_SHADER_ENGINES(3) >> 12) + 1;
-
         if ((rdev->family >= CHIP_CEDAR) && (rdev->family <= CHIP_HEMLOCK)) {
                 u32 efuse_straps_4;
                 u32 efuse_straps_3;
diff --git a/drivers/gpu/drm/radeon/kv_dpm.c b/drivers/gpu/drm/radeon/kv_dpm.c
index 1dd976f447fa..9b42001295ba 100644
--- a/drivers/gpu/drm/radeon/kv_dpm.c
+++ b/drivers/gpu/drm/radeon/kv_dpm.c
@@ -2725,7 +2725,11 @@ int kv_dpm_init(struct radeon_device *rdev)
 
         pi->sram_end = SMC_RAM_END;
 
-        pi->enable_nb_dpm = true;
+        /* Enabling nb dpm on an asrock system prevents dpm from working */
+        if (rdev->pdev->subsystem_vendor == 0x1849)
+                pi->enable_nb_dpm = false;
+        else
+                pi->enable_nb_dpm = true;
 
         pi->caps_power_containment = true;
         pi->caps_cac = true;
@@ -2740,10 +2744,19 @@ int kv_dpm_init(struct radeon_device *rdev)
         pi->caps_sclk_ds = true;
         pi->enable_auto_thermal_throttling = true;
         pi->disable_nb_ps3_in_battery = false;
-        if (radeon_bapm == 0)
+        if (radeon_bapm == -1) {
+                /* There are stability issues reported on with
+                 * bapm enabled on an asrock system.
+                 */
+                if (rdev->pdev->subsystem_vendor == 0x1849)
+                        pi->bapm_enable = false;
+                else
+                        pi->bapm_enable = true;
+        } else if (radeon_bapm == 0) {
                 pi->bapm_enable = false;
-        else
+        } else {
                 pi->bapm_enable = true;
+        }
         pi->voltage_drop_t = 0;
         pi->caps_sclk_throttle_low_notification = false;
         pi->caps_fps = false; /* true? */
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 10f8be0ee173..b53b31a7b76f 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3207,6 +3207,9 @@ void r100_bandwidth_update(struct radeon_device *rdev)
         uint32_t pixel_bytes1 = 0;
         uint32_t pixel_bytes2 = 0;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled) {
diff --git a/drivers/gpu/drm/radeon/r600_dma.c b/drivers/gpu/drm/radeon/r600_dma.c
index aabc343b9a8f..cf0df45d455e 100644
--- a/drivers/gpu/drm/radeon/r600_dma.c
+++ b/drivers/gpu/drm/radeon/r600_dma.c
@@ -338,17 +338,17 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
 {
         struct radeon_ib ib;
         unsigned i;
+        unsigned index;
         int r;
-        void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
         u32 tmp = 0;
+        u64 gpu_addr;
 
-        if (!ptr) {
-                DRM_ERROR("invalid vram scratch pointer\n");
-                return -EINVAL;
-        }
+        if (ring->idx == R600_RING_TYPE_DMA_INDEX)
+                index = R600_WB_DMA_RING_TEST_OFFSET;
+        else
+                index = CAYMAN_WB_DMA1_RING_TEST_OFFSET;
 
-        tmp = 0xCAFEDEAD;
-        writel(tmp, ptr);
+        gpu_addr = rdev->wb.gpu_addr + index;
 
         r = radeon_ib_get(rdev, ring->idx, &ib, NULL, 256);
         if (r) {
@@ -357,8 +357,8 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
         }
 
         ib.ptr[0] = DMA_PACKET(DMA_PACKET_WRITE, 0, 0, 1);
-        ib.ptr[1] = rdev->vram_scratch.gpu_addr & 0xfffffffc;
-        ib.ptr[2] = upper_32_bits(rdev->vram_scratch.gpu_addr) & 0xff;
+        ib.ptr[1] = lower_32_bits(gpu_addr);
+        ib.ptr[2] = upper_32_bits(gpu_addr) & 0xff;
         ib.ptr[3] = 0xDEADBEEF;
         ib.length_dw = 4;
 
@@ -374,7 +374,7 @@ int r600_dma_ib_test(struct radeon_device *rdev, struct radeon_ring *ring)
                 return r;
         }
         for (i = 0; i < rdev->usec_timeout; i++) {
-                tmp = readl(ptr);
+                tmp = le32_to_cpu(rdev->wb.wb[index/4]);
                 if (tmp == 0xDEADBEEF)
                         break;
                 DRM_UDELAY(1);
diff --git a/drivers/gpu/drm/radeon/r600_dpm.c b/drivers/gpu/drm/radeon/r600_dpm.c
index f6309bd23e01..b5c73df8e202 100644
--- a/drivers/gpu/drm/radeon/r600_dpm.c
+++ b/drivers/gpu/drm/radeon/r600_dpm.c
@@ -1256,7 +1256,7 @@ int r600_parse_extended_power_table(struct radeon_device *rdev)
                                         (mode_info->atom_context->bios + data_offset +
                                          le16_to_cpu(ext_hdr->usPowerTuneTableOffset));
                                 rdev->pm.dpm.dyn_state.cac_tdp_table->maximum_power_delivery_limit =
-                                        ppt->usMaximumPowerDeliveryLimit;
+                                        le16_to_cpu(ppt->usMaximumPowerDeliveryLimit);
                                 pt = &ppt->power_tune_table;
                         } else {
                                 ATOM_PPLIB_POWERTUNE_Table *ppt = (ATOM_PPLIB_POWERTUNE_Table *)
diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
index 6a03624fadaa..63ccb8fa799c 100644
--- a/drivers/gpu/drm/radeon/radeon_bios.c
+++ b/drivers/gpu/drm/radeon/radeon_bios.c
@@ -658,12 +658,10 @@ bool radeon_get_bios(struct radeon_device *rdev)
                 r = igp_read_bios_from_vram(rdev);
         if (r == false)
                 r = radeon_read_bios(rdev);
-        if (r == false) {
+        if (r == false)
                 r = radeon_read_disabled_bios(rdev);
-        }
-        if (r == false) {
+        if (r == false)
                 r = radeon_read_platform_bios(rdev);
-        }
         if (r == false || rdev->bios == NULL) {
                 DRM_ERROR("Unable to locate a BIOS ROM\n");
                 rdev->bios = NULL;
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 1c893447d7cd..a3e7aed7e680 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -450,7 +450,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error, bo
         kfree(parser->track);
         kfree(parser->relocs);
         kfree(parser->relocs_ptr);
-        kfree(parser->vm_bos);
+        drm_free_large(parser->vm_bos);
         for (i = 0; i < parser->nchunks; i++)
                 drm_free_large(parser->chunks[i].kdata);
         kfree(parser->chunks);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index ea2676954dde..995a8b1770dd 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -952,6 +952,7 @@ int radeon_atombios_init(struct radeon_device *rdev)
         }
 
         mutex_init(&rdev->mode_info.atom_context->mutex);
+        mutex_init(&rdev->mode_info.atom_context->scratch_mutex);
         radeon_atom_initialize_bios_scratch_regs(rdev->ddev);
         atom_allocate_fb_scratch(rdev->mode_info.atom_context);
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 9a19e52cc655..6b670b0bc47b 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -179,6 +179,9 @@ static void radeon_encoder_add_backlight(struct radeon_encoder *radeon_encoder,
                     (rdev->pdev->subsystem_vendor == 0x1734) &&
                     (rdev->pdev->subsystem_device == 0x1107))
                         use_bl = false;
+                /* disable native backlight control on older asics */
+                else if (rdev->family < CHIP_R600)
+                        use_bl = false;
                 else
                         use_bl = true;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 3d17af34afa7..2456f69efd23 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -314,7 +314,7 @@ unsigned radeon_ring_backup(struct radeon_device *rdev, struct radeon_ring *ring
         }
 
         /* and then save the content of the ring */
-        *data = kmalloc_array(size, sizeof(uint32_t), GFP_KERNEL);
+        *data = drm_malloc_ab(size, sizeof(uint32_t));
         if (!*data) {
                 mutex_unlock(&rdev->ring_lock);
                 return 0;
@@ -356,7 +356,7 @@ int radeon_ring_restore(struct radeon_device *rdev, struct radeon_ring *ring,
         }
 
         radeon_ring_unlock_commit(rdev, ring, false);
-        kfree(data);
+        drm_free_large(data);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index 4532cc76a0a6..dfde266529e2 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -132,8 +132,8 @@ struct radeon_cs_reloc *radeon_vm_get_bos(struct radeon_device *rdev,
         struct radeon_cs_reloc *list;
         unsigned i, idx;
 
-        list = kmalloc_array(vm->max_pde_used + 2,
-                             sizeof(struct radeon_cs_reloc), GFP_KERNEL);
+        list = drm_malloc_ab(vm->max_pde_used + 2,
+                             sizeof(struct radeon_cs_reloc));
         if (!list)
                 return NULL;
 
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 5f6db4629aaa..9acb1c3c005b 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -879,6 +879,9 @@ void rs600_bandwidth_update(struct radeon_device *rdev)
         u32 d1mode_priority_a_cnt, d2mode_priority_a_cnt;
         /* FIXME: implement full support */
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3462b64369bf..0a2d36e81108 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -579,6 +579,9 @@ void rs690_bandwidth_update(struct radeon_device *rdev)
         u32 d1mode_priority_a_cnt, d1mode_priority_b_cnt;
         u32 d2mode_priority_a_cnt, d2mode_priority_b_cnt;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 8a477bf1fdb3..c55d653aaf5f 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -1277,6 +1277,9 @@ void rv515_bandwidth_update(struct radeon_device *rdev)
         struct drm_display_mode *mode0 = NULL;
         struct drm_display_mode *mode1 = NULL;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         if (rdev->mode_info.crtcs[0]->base.enabled)
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index eeea5b6a1775..7d5083dc4acb 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2384,6 +2384,9 @@ void dce6_bandwidth_update(struct radeon_device *rdev)
         u32 num_heads = 0, lb_size;
         int i;
 
+        if (!rdev->mode_info.mode_config_initialized)
+                return;
+
         radeon_update_display_priority(rdev);
 
         for (i = 0; i < rdev->num_crtc; i++) {
diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
index a53c2e79d9cb..676e6c2ba90a 100644
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -6256,7 +6256,7 @@ static void si_parse_pplib_clock_info(struct radeon_device *rdev,
         if ((rps->class2 & ATOM_PPLIB_CLASSIFICATION2_ULV) &&
             index == 0) {
                 /* XXX disable for A0 tahiti */
-                si_pi->ulv.supported = true;
+                si_pi->ulv.supported = false;
                 si_pi->ulv.pl = *pl;
                 si_pi->ulv.one_pcie_lane_in_ulv = false;
                 si_pi->ulv.volt_change_delay = SISLANDS_ULVVOLTAGECHANGEDELAY_DFLT;
diff --git a/drivers/gpu/drm/tegra/dc.c b/drivers/gpu/drm/tegra/dc.c
index 6553fd238685..054a79f143ae 100644
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -736,7 +736,6 @@ static const struct drm_crtc_funcs tegra_crtc_funcs = {
 
 static void tegra_crtc_disable(struct drm_crtc *crtc)
 {
-        struct tegra_dc *dc = to_tegra_dc(crtc);
         struct drm_device *drm = crtc->dev;
         struct drm_plane *plane;
 
@@ -752,7 +751,7 @@ static void tegra_crtc_disable(struct drm_crtc *crtc)
                 }
         }
 
-        drm_vblank_off(drm, dc->pipe);
+        drm_crtc_vblank_off(crtc);
 }
 
 static bool tegra_crtc_mode_fixup(struct drm_crtc *crtc,
@@ -841,8 +840,6 @@ static int tegra_crtc_mode_set(struct drm_crtc *crtc,
         u32 value;
         int err;
 
-        drm_vblank_pre_modeset(crtc->dev, dc->pipe);
-
         err = tegra_crtc_setup_clk(crtc, mode);
         if (err) {
                 dev_err(dc->dev, "failed to setup clock for CRTC: %d\n", err);
@@ -896,6 +893,8 @@ static void tegra_crtc_prepare(struct drm_crtc *crtc)
         unsigned int syncpt;
         unsigned long value;
 
+        drm_crtc_vblank_off(crtc);
+
         /* hardware initialization */
         reset_control_deassert(dc->rst);
         usleep_range(10000, 20000);
@@ -943,7 +942,7 @@ static void tegra_crtc_commit(struct drm_crtc *crtc)
         value = GENERAL_ACT_REQ | WIN_A_ACT_REQ;
         tegra_dc_writel(dc, value, DC_CMD_STATE_CONTROL);
 
-        drm_vblank_post_modeset(crtc->dev, dc->pipe);
+        drm_crtc_vblank_on(crtc);
 }
 
 static void tegra_crtc_load_lut(struct drm_crtc *crtc)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
index bfeb4b1f2acf..21e9b7f8dad0 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c
@@ -246,7 +246,8 @@ int vmw_cmdbuf_res_remove(struct vmw_cmdbuf_res_manager *man,
         struct drm_hash_item *hash;
         int ret;
 
-        ret = drm_ht_find_item(&man->resources, user_key, &hash);
+        ret = drm_ht_find_item(&man->resources, user_key | (res_type << 24),
+                               &hash);
         if (likely(ret != 0))
                 return -EINVAL;
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 7197af157313..25f3c250fd98 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -688,7 +688,11 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                 goto out_err0;
         }
 
-        if (unlikely(dev_priv->prim_bb_mem < dev_priv->vram_size))
+        /*
+         * Limit back buffer size to VRAM size.  Remove this once
+         * screen targets are implemented.
+         */
+        if (dev_priv->prim_bb_mem > dev_priv->vram_size)
                 dev_priv->prim_bb_mem = dev_priv->vram_size;
 
         mutex_unlock(&dev_priv->hw_mutex);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index d2bc2b03d4c6..941a7bc0b791 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -187,7 +187,7 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
          * can do this since the caller in the drm core doesn't check anything
          * which is protected by any looks.
          */
-        drm_modeset_unlock(&crtc->mutex);
+        drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
 
         /* A lot of the code assumes this */
@@ -252,7 +252,7 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         ret = 0;
 out:
         drm_modeset_unlock_all(dev_priv->dev);
-        drm_modeset_lock(&crtc->mutex, NULL);
+        drm_modeset_lock_crtc(crtc);
 
         return ret;
 }
@@ -273,7 +273,7 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
          * can do this since the caller in the drm core doesn't check anything
          * which is protected by any looks.
          */
-        drm_modeset_unlock(&crtc->mutex);
+        drm_modeset_unlock_crtc(crtc);
         drm_modeset_lock_all(dev_priv->dev);
 
         vmw_cursor_update_position(dev_priv, shown,
@@ -281,7 +281,7 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
                                    du->cursor_y + du->hotspot_y);
 
         drm_modeset_unlock_all(dev_priv->dev);
-        drm_modeset_lock(&crtc->mutex, NULL);
+        drm_modeset_lock_crtc(crtc);
 
         return 0;
 }
@@ -1950,6 +1950,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
         };
         int i;
+        u32 assumed_bpp = 2;
+
+        /*
+         * If using screen objects, then assume 32-bpp because that's what the
+         * SVGA device is assuming
+         */
+        if (dev_priv->sou_priv)
+                assumed_bpp = 4;
 
         /* Add preferred mode */
         {
@@ -1960,8 +1968,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                 mode->vdisplay = du->pref_height;
                 vmw_guess_mode_timing(mode);
 
-                if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2,
-                                               mode->vdisplay)) {
+                if (vmw_kms_validate_mode_vram(dev_priv,
+                                                mode->hdisplay * assumed_bpp,
+                                                mode->vdisplay)) {
                         drm_mode_probed_add(connector, mode);
                 } else {
                         drm_mode_destroy(dev, mode);
@@ -1983,7 +1992,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
                     bmode->vdisplay > max_height)
                         continue;
 
-                if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2,
+                if (!vmw_kms_validate_mode_vram(dev_priv,
+                                                bmode->hdisplay * assumed_bpp,
                                                 bmode->vdisplay))
                         continue;
 
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 73bd9e2e42bc..3402033fa52a 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1659,6 +1659,7 @@ void hid_disconnect(struct hid_device *hdev)
                 hdev->hiddev_disconnect(hdev);
         if (hdev->claimed & HID_CLAIMED_HIDRAW)
                 hidraw_disconnect(hdev);
+        hdev->claimed = 0;
 }
 EXPORT_SYMBOL_GPL(hid_disconnect);
 
diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c
index 84c3cb15ccdd..8bf61d295ffd 100644
--- a/drivers/hid/hid-debug.c
+++ b/drivers/hid/hid-debug.c
@@ -946,6 +946,12 @@ static const char *keys[KEY_MAX + 1] = {
         [KEY_BRIGHTNESS_MIN] = "BrightnessMin",
         [KEY_BRIGHTNESS_MAX] = "BrightnessMax",
         [KEY_BRIGHTNESS_AUTO] = "BrightnessAuto",
+        [KEY_KBDINPUTASSIST_PREV] = "KbdInputAssistPrev",
+        [KEY_KBDINPUTASSIST_NEXT] = "KbdInputAssistNext",
+        [KEY_KBDINPUTASSIST_PREVGROUP] = "KbdInputAssistPrevGroup",
+        [KEY_KBDINPUTASSIST_NEXTGROUP] = "KbdInputAssistNextGroup",
+        [KEY_KBDINPUTASSIST_ACCEPT] = "KbdInputAssistAccept",
+        [KEY_KBDINPUTASSIST_CANCEL] = "KbdInputAssistCancel",
 };
 
 static const char *relatives[REL_MAX + 1] = {
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index cd9c9e96cf0e..7c863738e419 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -298,6 +298,9 @@
 
 #define USB_VENDOR_ID_ELAN              0x04f3
 #define USB_DEVICE_ID_ELAN_TOUCHSCREEN  0x0089
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B     0x009b
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103     0x0103
+#define USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F     0x016f
 
 #define USB_VENDOR_ID_ELECOM            0x056e
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
index 2df7fddbd119..725f22ca47fc 100644
--- a/drivers/hid/hid-input.c
+++ b/drivers/hid/hid-input.c
@@ -695,7 +695,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                         break;
 
                 case 0x5b: /* TransducerSerialNumber */
-                        set_bit(MSC_SERIAL, input->mscbit);
+                        usage->type = EV_MSC;
+                        usage->code = MSC_SERIAL;
+                        bit = input->mscbit;
+                        max = MSC_MAX;
                         break;
 
                 default:  goto unknown;
@@ -862,6 +865,13 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
                 case 0x28b: map_key_clear(KEY_FORWARDMAIL);     break;
                 case 0x28c: map_key_clear(KEY_SEND);            break;
 
+                case 0x2c7: map_key_clear(KEY_KBDINPUTASSIST_PREV);             break;
+                case 0x2c8: map_key_clear(KEY_KBDINPUTASSIST_NEXT);             break;
+                case 0x2c9: map_key_clear(KEY_KBDINPUTASSIST_PREVGROUP);                break;
+                case 0x2ca: map_key_clear(KEY_KBDINPUTASSIST_NEXTGROUP);                break;
+                case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT);   break;
+                case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL);   break;
+
                 default:    goto ignore;
                 }
                 break;
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index f3cb5b0a4345..552671ee7c5d 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -71,6 +71,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_0103, HID_QUIRK_ALWAYS_POLL },
+        { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_016F, HID_QUIRK_ALWAYS_POLL },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index fcdbde4ec692..3057dfc7e3bc 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -234,7 +234,7 @@ static const struct pci_device_id fam15h_power_id_table[] = {
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F4) },
         { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
-        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F4) },
         {}
 };
 MODULE_DEVICE_TABLE(pci, fam15h_power_id_table);
diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index d2bf2c97ae70..6a30eeea94be 100644
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -181,7 +181,7 @@ static int __init populate_attr_groups(struct platform_device *pdev)
 
         opal = of_find_node_by_path("/ibm,opal/sensors");
         if (!opal) {
-                dev_err(&pdev->dev, "Opal node 'sensors' not found\n");
+                dev_dbg(&pdev->dev, "Opal node 'sensors' not found\n");
                 return -ENODEV;
         }
 
@@ -335,7 +335,9 @@ static int __init ibmpowernv_init(void)
 
         err = platform_driver_probe(&ibmpowernv_driver, ibmpowernv_probe);
         if (err) {
-                pr_err("Platfrom driver probe failed\n");
+                if (err != -ENODEV)
+                        pr_err("Platform driver probe failed (%d)\n", err);
+
                 goto exit_device_del;
         }
 
diff --git a/drivers/hwmon/pwm-fan.c b/drivers/hwmon/pwm-fan.c
index 823c877a1ec0..1991d9032c38 100644
--- a/drivers/hwmon/pwm-fan.c
+++ b/drivers/hwmon/pwm-fan.c
@@ -161,10 +161,17 @@ static int pwm_fan_suspend(struct device *dev)
 static int pwm_fan_resume(struct device *dev)
 {
         struct pwm_fan_ctx *ctx = dev_get_drvdata(dev);
+        unsigned long duty;
+        int ret;
 
-        if (ctx->pwm_value)
-                return pwm_enable(ctx->pwm);
-        return 0;
+        if (ctx->pwm_value == 0)
+                return 0;
+
+        duty = DIV_ROUND_UP(ctx->pwm_value * (ctx->pwm->period - 1), MAX_PWM);
+        ret = pwm_config(ctx->pwm, duty, ctx->pwm->period);
+        if (ret)
+                return ret;
+        return pwm_enable(ctx->pwm);
 }
 #endif
 
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index 65ef9664d5da..899bede81b31 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -12,11 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.
  * ------------------------------------------------------------------------- */
 
 /* With some changes from Frodo Looijaard <frodol@dds.nl>, Kyösti Mälkki
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 8b10f88b13d9..580dbf05c148 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -12,11 +12,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- *  MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/algos/i2c-algo-pcf.c b/drivers/i2c/algos/i2c-algo-pcf.c
index 34370090b753..270d84bfc2c6 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.c
+++ b/drivers/i2c/algos/i2c-algo-pcf.c
@@ -14,11 +14,6 @@
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  *  GNU General Public License for more details.
  *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- *  MA 02110-1301 USA.
- *
  * With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi> and
  * Frodo Looijaard <frodol@dds.nl>, and also from Martin Bailey
  * <mbailey@littlefeet-inc.com>
diff --git a/drivers/i2c/algos/i2c-algo-pcf.h b/drivers/i2c/algos/i2c-algo-pcf.h
index 1ec703ee788d..262ee801975b 100644
--- a/drivers/i2c/algos/i2c-algo-pcf.h
+++ b/drivers/i2c/algos/i2c-algo-pcf.h
@@ -12,12 +12,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.                                                  */
+    GNU General Public License for more details.                        */
 /* -------------------------------------------------------------------- */
 
 /* With some changes from Frodo Looijaard <frodol@dds.nl> */
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 451e305f7971..4f2d78868281 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -14,10 +14,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 2fa21ce9682b..45c5c4883022 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -12,10 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-amd756-s4882.c b/drivers/i2c/busses/i2c-amd756-s4882.c
index 41fc6837fb8b..65e324054970 100644
--- a/drivers/i2c/busses/i2c-amd756-s4882.c
+++ b/drivers/i2c/busses/i2c-amd756-s4882.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
  
 /*
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index a16f72891358..6c7113d990f8 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
index 917d54588d95..e05a672db3e5 100644
--- a/drivers/i2c/busses/i2c-at91.c
+++ b/drivers/i2c/busses/i2c-at91.c
@@ -434,7 +434,7 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
                 }
         }
 
-        ret = wait_for_completion_io_timeout(&dev->cmd_complete,
+        ret = wait_for_completion_timeout(&dev->cmd_complete,
                                              dev->adapter.timeout);
         if (ret == 0) {
                 dev_err(dev->dev, "controller timed out\n");
diff --git a/drivers/i2c/busses/i2c-au1550.c b/drivers/i2c/busses/i2c-au1550.c
index 8762458ca7da..6f8c0756e350 100644
--- a/drivers/i2c/busses/i2c-au1550.c
+++ b/drivers/i2c/busses/i2c-au1550.c
@@ -21,10 +21,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/delay.h>
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f3b89a4698b6..5bdbc71698d0 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -23,10 +23,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 4d9614719128..d15b7c9b9219 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -17,10 +17,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index 3c20e4bd6dd1..edca99dbba23 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-core.h b/drivers/i2c/busses/i2c-designware-core.h
index d66b6cbc9edc..5a410ef17abd 100644
--- a/drivers/i2c/busses/i2c-designware-core.h
+++ b/drivers/i2c/busses/i2c-designware-core.h
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-pcidrv.c b/drivers/i2c/busses/i2c-designware-pcidrv.c
index d31d313ab4f7..acb40f95db78 100644
--- a/drivers/i2c/busses/i2c-designware-pcidrv.c
+++ b/drivers/i2c/busses/i2c-designware-pcidrv.c
@@ -19,10 +19,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
index a7431150acf7..373dd4d47765 100644
--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
@@ -18,10 +18,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ----------------------------------------------------------------------------
  *
  */
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index a44ea13d1434..76e699f9ed97 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -9,10 +9,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-elektor.c b/drivers/i2c/busses/i2c-elektor.c
index 485497066ed7..92e8c0ce1625 100644
--- a/drivers/i2c/busses/i2c-elektor.c
+++ b/drivers/i2c/busses/i2c-elektor.c
@@ -12,11 +12,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.                */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 /* With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi> and even
diff --git a/drivers/i2c/busses/i2c-hydra.c b/drivers/i2c/busses/i2c-hydra.c
index 14d2b76de25f..b7864cf42a72 100644
--- a/drivers/i2c/busses/i2c-hydra.c
+++ b/drivers/i2c/busses/i2c-hydra.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 7cfc183b3d63..6ab4f1cb21f3 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -15,10 +15,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index c48e46af670a..e9fb7cf78612 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -11,11 +11,6 @@
  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *      GNU General Public License for more details.
  *
- *      You should have received a copy of the GNU General Public License
- *      along with this program; if not, write to the Free Software
- *      Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
- *      USA.
- *
  * Author:
  *      Darius Augulis, Teltonika Inc.
  *
diff --git a/drivers/i2c/busses/i2c-iop3xx.h b/drivers/i2c/busses/i2c-iop3xx.h
index 097e270955d0..2d6929c2bd92 100644
--- a/drivers/i2c/busses/i2c-iop3xx.h
+++ b/drivers/i2c/busses/i2c-iop3xx.h
@@ -11,11 +11,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.                */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 
diff --git a/drivers/i2c/busses/i2c-isch.c b/drivers/i2c/busses/i2c-isch.c
index cf99dbf21fd1..113293d275f6 100644
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -14,10 +14,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 3f6ecbfb9a56..f2b0ff011631 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -14,10 +14,6 @@
  * WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin St - Fifth Floor, Boston, MA 02110-1301 USA.
  * The full GNU General Public License is included in this distribution
  * in the file called LICENSE.GPL.
  *
diff --git a/drivers/i2c/busses/i2c-nforce2-s4985.c b/drivers/i2c/busses/i2c-nforce2-s4985.c
index b170bdffb5de..88eda09e73c0 100644
--- a/drivers/i2c/busses/i2c-nforce2-s4985.c
+++ b/drivers/i2c/busses/i2c-nforce2-s4985.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 /*
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index ee3a76c7ae97..70b3c9158509 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -17,10 +17,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 0dffb0e62c3b..26942c159de1 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -22,10 +22,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-parport-light.c b/drivers/i2c/busses/i2c-parport-light.c
index 62f55fe624cb..d1f625f923c7 100644
--- a/drivers/i2c/busses/i2c-parport-light.c
+++ b/drivers/i2c/busses/i2c-parport-light.c
@@ -18,10 +18,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
index a27aae2d6757..a1fac5aa9bae 100644
--- a/drivers/i2c/busses/i2c-parport.c
+++ b/drivers/i2c/busses/i2c-parport.c
@@ -18,10 +18,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-parport.h b/drivers/i2c/busses/i2c-parport.h
index e572f3aac0f7..4e1294536805 100644
--- a/drivers/i2c/busses/i2c-parport.h
+++ b/drivers/i2c/busses/i2c-parport.h
@@ -12,10 +12,6 @@
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU General Public License for more details.
-
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  * ------------------------------------------------------------------------ */
 
 #define PORT_DATA       0
diff --git a/drivers/i2c/busses/i2c-pasemi.c b/drivers/i2c/busses/i2c-pasemi.c
index 7a9dce43e115..df1dbc92a024 100644
--- a/drivers/i2c/busses/i2c-pasemi.c
+++ b/drivers/i2c/busses/i2c-pasemi.c
@@ -11,10 +11,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
  */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index 323f061a3163..e0eb4ca0102e 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -12,10 +12,6 @@
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c
index a6f54ba27e2a..67cbec6796a0 100644
--- a/drivers/i2c/busses/i2c-piix4.c
+++ b/drivers/i2c/busses/i2c-piix4.c
@@ -11,10 +11,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c
index 8564768fee32..177834e2d841 100644
--- a/drivers/i2c/busses/i2c-pmcmsp.c
+++ b/drivers/i2c/busses/i2c-pmcmsp.c
@@ -18,10 +18,6 @@
  *  ANY THEORY OF LIABILITY, WHETHER IN  CONTRACT, STRICT LIABILITY, OR TORT
  *  (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  *  THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- *  You should have received a copy of the  GNU General Public License along
- *  with this program; if not, write  to the Free Software Foundation, Inc.,
- *  675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-powermac.c b/drivers/i2c/busses/i2c-powermac.c
index 01e967763c2a..60a53c169ed2 100644
--- a/drivers/i2c/busses/i2c-powermac.c
+++ b/drivers/i2c/busses/i2c-powermac.c
@@ -14,10 +14,6 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
 
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
 */
 
 #include <linux/module.h>
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index e3b0337faeb7..65244774bfa3 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -14,10 +14,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c
index 8b5e79cb4468..4855188747c9 100644
--- a/drivers/i2c/busses/i2c-sh_mobile.c
+++ b/drivers/i2c/busses/i2c-sh_mobile.c
@@ -14,10 +14,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sibyte.c b/drivers/i2c/busses/i2c-sibyte.c
index 0fe505d7abe9..2b6219d86b0f 100644
--- a/drivers/i2c/busses/i2c-sibyte.c
+++ b/drivers/i2c/busses/i2c-sibyte.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-simtec.c b/drivers/i2c/busses/i2c-simtec.c
index 964e5c6f84ab..15ac8395dcd3 100644
--- a/drivers/i2c/busses/i2c-simtec.c
+++ b/drivers/i2c/busses/i2c-simtec.c
@@ -12,10 +12,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index ac9bc33acef4..7d58a40faf2d 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -11,10 +11,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /* Note: we assume there can only be one SIS5595 with one SMBus interface */
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index c6366733008d..1e6805b5cef2 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -10,10 +10,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 8dc2fc5f74ff..44b904426073 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -10,10 +10,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-taos-evm.c b/drivers/i2c/busses/i2c-taos-evm.c
index 10855a0b7e7f..4c7fc2d47014 100644
--- a/drivers/i2c/busses/i2c-taos-evm.c
+++ b/drivers/i2c/busses/i2c-taos-evm.c
@@ -13,10 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
  */
 
 #include <linux/delay.h>
diff --git a/drivers/i2c/busses/i2c-via.c b/drivers/i2c/busses/i2c-via.c
index f4a1ed757612..59b1d233ca7b 100644
--- a/drivers/i2c/busses/i2c-via.c
+++ b/drivers/i2c/busses/i2c-via.c
@@ -12,10 +12,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/busses/i2c-viapro.c b/drivers/i2c/busses/i2c-viapro.c
index 6841200b6e50..0ee2646f3b00 100644
--- a/drivers/i2c/busses/i2c-viapro.c
+++ b/drivers/i2c/busses/i2c-viapro.c
@@ -13,10 +13,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 /*
diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
index ade9223912d3..cc65ea0b818f 100644
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -12,10 +12,6 @@
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
  *
  * This code was implemented by Mocean Laboratories AB when porting linux
  * to the automotive development board Russellville. The copyright holder
diff --git a/drivers/i2c/busses/scx200_acb.c b/drivers/i2c/busses/scx200_acb.c
index ff3f5747e43b..5153354b1a6b 100644
--- a/drivers/i2c/busses/scx200_acb.c
+++ b/drivers/i2c/busses/scx200_acb.c
@@ -17,10 +17,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
diff --git a/drivers/i2c/i2c-boardinfo.c b/drivers/i2c/i2c-boardinfo.c
index f24cc64e2e8c..90e322959303 100644
--- a/drivers/i2c/i2c-boardinfo.c
+++ b/drivers/i2c/i2c-boardinfo.c
@@ -10,11 +10,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 2f90ac6a7f79..f43b4e11647a 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -10,12 +10,7 @@
     This program is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.                                                       */
+    GNU General Public License for more details.                             */
 /* ------------------------------------------------------------------------- */
 
 /* With some changes from Kyösti Mälkki <kmalkki@cc.hut.fi>.
@@ -670,6 +665,9 @@ static int i2c_device_remove(struct device *dev)
                 status = driver->remove(client);
         }
 
+        if (dev->of_node)
+                irq_dispose_mapping(client->irq);
+
         dev_pm_domain_detach(&client->dev, true);
         return status;
 }
diff --git a/drivers/i2c/i2c-core.h b/drivers/i2c/i2c-core.h
index 18a8fd21d2c2..17700bfddcf5 100644
--- a/drivers/i2c/i2c-core.h
+++ b/drivers/i2c/i2c-core.h
@@ -10,11 +10,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/rwsem.h>
diff --git a/drivers/i2c/i2c-dev.c b/drivers/i2c/i2c-dev.c
index 80b47e8ce030..71c7a3975b62 100644
--- a/drivers/i2c/i2c-dev.c
+++ b/drivers/i2c/i2c-dev.c
@@ -14,11 +14,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
-    MA 02110-1301 USA.
 */
 
 /* Note that this is a complete rewrite of Simon Vogl's i2c-dev module.
diff --git a/drivers/i2c/i2c-smbus.c b/drivers/i2c/i2c-smbus.c
index fc99f0d6b4a5..9ebf9cb4ad7a 100644
--- a/drivers/i2c/i2c-smbus.c
+++ b/drivers/i2c/i2c-smbus.c
@@ -13,11 +13,6 @@
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
- * MA 02110-1301 USA.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/i2c/i2c-stub.c b/drivers/i2c/i2c-stub.c
index d241aa295d96..af2a94e1140b 100644
--- a/drivers/i2c/i2c-stub.c
+++ b/drivers/i2c/i2c-stub.c
@@ -13,10 +13,6 @@
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
 
 #define DEBUG 1
diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
index 98909a9e284e..a23e58c4ed99 100644
--- a/drivers/iio/accel/kxcjk-1013.c
+++ b/drivers/iio/accel/kxcjk-1013.c
@@ -894,7 +894,7 @@ static const struct attribute_group kxcjk1013_attrs_group = {
 
 static const struct iio_event_spec kxcjk1013_event = {
                 .type = IIO_EV_TYPE_THRESH,
-                .dir = IIO_EV_DIR_RISING | IIO_EV_DIR_FALLING,
+                .dir = IIO_EV_DIR_EITHER,
                 .mask_separate = BIT(IIO_EV_INFO_VALUE) |
                                  BIT(IIO_EV_INFO_ENABLE) |
                                  BIT(IIO_EV_INFO_PERIOD)
diff --git a/drivers/iio/common/st_sensors/st_sensors_buffer.c b/drivers/iio/common/st_sensors/st_sensors_buffer.c
index 1665c8e4b62b..e18bc6782256 100644
--- a/drivers/iio/common/st_sensors/st_sensors_buffer.c
+++ b/drivers/iio/common/st_sensors/st_sensors_buffer.c
@@ -71,7 +71,7 @@ int st_sensors_get_buffer_element(struct iio_dev *indio_dev, u8 *buf)
                                 goto st_sensors_free_memory;
                         }
 
-                        for (i = 0; i < n * num_data_channels; i++) {
+                        for (i = 0; i < n * byte_for_channel; i++) {
                                 if (i < n)
                                         buf[i] = rx_array[i];
                                 else
diff --git a/drivers/iio/light/tsl4531.c b/drivers/iio/light/tsl4531.c
index a15006efa137..0763b8632573 100644
--- a/drivers/iio/light/tsl4531.c
+++ b/drivers/iio/light/tsl4531.c
@@ -230,9 +230,12 @@ static int tsl4531_resume(struct device *dev)
         return i2c_smbus_write_byte_data(to_i2c_client(dev), TSL4531_CONTROL,
                 TSL4531_MODE_NORMAL);
 }
-#endif
 
 static SIMPLE_DEV_PM_OPS(tsl4531_pm_ops, tsl4531_suspend, tsl4531_resume);
+#define TSL4531_PM_OPS (&tsl4531_pm_ops)
+#else
+#define TSL4531_PM_OPS NULL
+#endif
 
 static const struct i2c_device_id tsl4531_id[] = {
         { "tsl4531", 0 },
@@ -243,7 +246,7 @@ MODULE_DEVICE_TABLE(i2c, tsl4531_id);
 static struct i2c_driver tsl4531_driver = {
         .driver = {
                 .name   = TSL4531_DRV_NAME,
-                .pm     = &tsl4531_pm_ops,
+                .pm     = TSL4531_PM_OPS,
                 .owner  = THIS_MODULE,
         },
         .probe  = tsl4531_probe,
diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c
index 5e780ef206f3..8349cc0fdf66 100644
--- a/drivers/iio/proximity/as3935.c
+++ b/drivers/iio/proximity/as3935.c
@@ -330,7 +330,7 @@ static int as3935_probe(struct spi_device *spi)
                 return -EINVAL;
         }
 
-        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(st));
+        indio_dev = devm_iio_device_alloc(&spi->dev, sizeof(*st));
         if (!indio_dev)
                 return -ENOMEM;
 
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index bda5994ceb68..8b72cf392b34 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -1173,18 +1173,24 @@ static struct ib_flow *mlx4_ib_create_flow(struct ib_qp *qp,
                 err = __mlx4_ib_create_flow(qp, flow_attr, domain, type[i],
                                             &mflow->reg_id[i]);
                 if (err)
-                        goto err_free;
+                        goto err_create_flow;
                 i++;
         }
 
         if (i < ARRAY_SIZE(type) && flow_attr->type == IB_FLOW_ATTR_NORMAL) {
                 err = mlx4_ib_tunnel_steer_add(qp, flow_attr, &mflow->reg_id[i]);
                 if (err)
-                        goto err_free;
+                        goto err_create_flow;
+                i++;
         }
 
         return &mflow->ibflow;
 
+err_create_flow:
+        while (i) {
+                (void)__mlx4_ib_destroy_flow(to_mdev(qp->device)->dev, mflow->reg_id[i]);
+                i--;
+        }
 err_free:
         kfree(mflow);
         return ERR_PTR(err);
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 3effa931fce2..10641b7816f4 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -115,9 +115,12 @@ isert_conn_setup_qp(struct isert_conn *isert_conn, struct rdma_cm_id *cma_id,
         attr.cap.max_recv_wr = ISERT_QP_MAX_RECV_DTOS;
         /*
          * FIXME: Use devattr.max_sge - 2 for max_send_sge as
-         * work-around for RDMA_READ..
+         * work-around for RDMA_READs with ConnectX-2.
+         *
+         * Also, still make sure to have at least two SGEs for
+         * outgoing control PDU responses.
          */
-        attr.cap.max_send_sge = device->dev_attr.max_sge - 2;
+        attr.cap.max_send_sge = max(2, device->dev_attr.max_sge - 2);
         isert_conn->max_sge = attr.cap.max_send_sge;
 
         attr.cap.max_recv_sge = 1;
@@ -225,12 +228,16 @@ isert_create_device_ib_res(struct isert_device *device)
         struct isert_cq_desc *cq_desc;
         struct ib_device_attr *dev_attr;
         int ret = 0, i, j;
+        int max_rx_cqe, max_tx_cqe;
 
         dev_attr = &device->dev_attr;
         ret = isert_query_device(ib_dev, dev_attr);
         if (ret)
                 return ret;
 
+        max_rx_cqe = min(ISER_MAX_RX_CQ_LEN, dev_attr->max_cqe);
+        max_tx_cqe = min(ISER_MAX_TX_CQ_LEN, dev_attr->max_cqe);
+
         /* asign function handlers */
         if (dev_attr->device_cap_flags & IB_DEVICE_MEM_MGT_EXTENSIONS &&
             dev_attr->device_cap_flags & IB_DEVICE_SIGNATURE_HANDOVER) {
@@ -272,7 +279,7 @@ isert_create_device_ib_res(struct isert_device *device)
                                                 isert_cq_rx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
-                                                ISER_MAX_RX_CQ_LEN, i);
+                                                max_rx_cqe, i);
                 if (IS_ERR(device->dev_rx_cq[i])) {
                         ret = PTR_ERR(device->dev_rx_cq[i]);
                         device->dev_rx_cq[i] = NULL;
@@ -284,7 +291,7 @@ isert_create_device_ib_res(struct isert_device *device)
                                                 isert_cq_tx_callback,
                                                 isert_cq_event_callback,
                                                 (void *)&cq_desc[i],
-                                                ISER_MAX_TX_CQ_LEN, i);
+                                                max_tx_cqe, i);
                 if (IS_ERR(device->dev_tx_cq[i])) {
                         ret = PTR_ERR(device->dev_tx_cq[i]);
                         device->dev_tx_cq[i] = NULL;
@@ -803,14 +810,25 @@ wake_up:
         complete(&isert_conn->conn_wait);
 }
 
-static void
+static int
 isert_disconnected_handler(struct rdma_cm_id *cma_id, bool disconnect)
 {
-        struct isert_conn *isert_conn = (struct isert_conn *)cma_id->context;
+        struct isert_conn *isert_conn;
+
+        if (!cma_id->qp) {
+                struct isert_np *isert_np = cma_id->context;
+
+                isert_np->np_cm_id = NULL;
+                return -1;
+        }
+
+        isert_conn = (struct isert_conn *)cma_id->context;
 
         isert_conn->disconnect = disconnect;
         INIT_WORK(&isert_conn->conn_logout_work, isert_disconnect_work);
         schedule_work(&isert_conn->conn_logout_work);
+
+        return 0;
 }
 
 static int
@@ -825,6 +843,9 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         switch (event->event) {
         case RDMA_CM_EVENT_CONNECT_REQUEST:
                 ret = isert_connect_request(cma_id, event);
+                if (ret)
+                        pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
+                                event->event, ret);
                 break;
         case RDMA_CM_EVENT_ESTABLISHED:
                 isert_connected_handler(cma_id);
@@ -834,7 +855,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
         case RDMA_CM_EVENT_DEVICE_REMOVAL: /* FALLTHRU */
                 disconnect = true;
         case RDMA_CM_EVENT_TIMEWAIT_EXIT:  /* FALLTHRU */
-                isert_disconnected_handler(cma_id, disconnect);
+                ret = isert_disconnected_handler(cma_id, disconnect);
                 break;
         case RDMA_CM_EVENT_CONNECT_ERROR:
         default:
@@ -842,12 +863,6 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
                 break;
         }
 
-        if (ret != 0) {
-                pr_err("isert_cma_handler failed RDMA_CM_EVENT: 0x%08x %d\n",
-                       event->event, ret);
-                dump_stack();
-        }
-
         return ret;
 }
 
@@ -3190,7 +3205,8 @@ isert_free_np(struct iscsi_np *np)
 {
         struct isert_np *isert_np = (struct isert_np *)np->np_context;
 
-        rdma_destroy_id(isert_np->np_cm_id);
+        if (isert_np->np_cm_id)
+                rdma_destroy_id(isert_np->np_cm_id);
 
         np->np_context = NULL;
         kfree(isert_np);
diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 7206547c13ce..dc829682701a 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -2092,6 +2092,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
         if (!qp_init)
                 goto out;
 
+retry:
         ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
                               ch->rq_size + srp_sq_size, 0);
         if (IS_ERR(ch->cq)) {
@@ -2115,6 +2116,13 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
         ch->qp = ib_create_qp(sdev->pd, qp_init);
         if (IS_ERR(ch->qp)) {
                 ret = PTR_ERR(ch->qp);
+                if (ret == -ENOMEM) {
+                        srp_sq_size /= 2;
+                        if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
+                                ib_destroy_cq(ch->cq);
+                                goto retry;
+                        }
+                }
                 printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
                 goto err_destroy_cq;
         }
diff --git a/drivers/input/keyboard/opencores-kbd.c b/drivers/input/keyboard/opencores-kbd.c
index 62abe2c16670..f8502bb29176 100644
--- a/drivers/input/keyboard/opencores-kbd.c
+++ b/drivers/input/keyboard/opencores-kbd.c
@@ -70,7 +70,7 @@ static int opencores_kbd_probe(struct platform_device *pdev)
 
         opencores_kbd->addr = devm_ioremap_resource(&pdev->dev, res);
         if (IS_ERR(opencores_kbd->addr))
-                error = PTR_ERR(opencores_kbd->addr);
+                return PTR_ERR(opencores_kbd->addr);
 
         input->name = pdev->name;
         input->phys = "opencores-kbd/input0";
diff --git a/drivers/input/keyboard/stmpe-keypad.c b/drivers/input/keyboard/stmpe-keypad.c
index c6727dda68f2..ef5e67fb567e 100644
--- a/drivers/input/keyboard/stmpe-keypad.c
+++ b/drivers/input/keyboard/stmpe-keypad.c
@@ -86,7 +86,7 @@ static const struct stmpe_keypad_variant stmpe_keypad_variants[] = {
                 .max_cols               = 8,
                 .max_rows               = 12,
                 .col_gpios              = 0x0000ff,     /* GPIO 0 - 7*/
-                .row_gpios              = 0x1fef00,     /* GPIO 8-14, 16-20 */
+                .row_gpios              = 0x1f7f00,     /* GPIO 8-14, 16-20 */
         },
         [STMPE2403] = {
                 .auto_increment         = true,
diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 719410feb84b..afed8e2b2f94 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1381,7 +1381,7 @@ static ssize_t ims_pcu_ofn_reg_addr_store(struct device *dev,
         pcu->ofn_reg_addr = value;
         mutex_unlock(&pcu->cmd_mutex);
 
-        return error ?: count;
+        return count;
 }
 
 static DEVICE_ATTR(reg_addr, S_IRUGO | S_IWUSR,
diff --git a/drivers/input/misc/max77693-haptic.c b/drivers/input/misc/max77693-haptic.c
index 7b1fde93799e..ef6a9d650d69 100644
--- a/drivers/input/misc/max77693-haptic.c
+++ b/drivers/input/misc/max77693-haptic.c
@@ -194,7 +194,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
                                        struct ff_effect *effect)
 {
         struct max77693_haptic *haptic = input_get_drvdata(dev);
-        uint64_t period_mag_multi;
+        u64 period_mag_multi;
 
         haptic->magnitude = effect->u.rumble.strong_magnitude;
         if (!haptic->magnitude)
@@ -205,8 +205,7 @@ static int max77693_haptic_play_effect(struct input_dev *dev, void *data,
          * The formula to convert magnitude to pwm_duty as follows:
          * - pwm_duty = (magnitude * pwm_period) / MAX_MAGNITUDE(0xFFFF)
          */
-        period_mag_multi = (int64_t)(haptic->pwm_dev->period *
-                                                haptic->magnitude);
+        period_mag_multi = (u64)haptic->pwm_dev->period * haptic->magnitude;
         haptic->pwm_duty = (unsigned int)(period_mag_multi >>
                                                 MAX_MAGNITUDE_SHIFT);
 
diff --git a/drivers/input/misc/soc_button_array.c b/drivers/input/misc/soc_button_array.c
index 735604753568..e097f1ab427f 100644
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -55,7 +55,7 @@ static int soc_button_lookup_gpio(struct device *dev, int acpi_index)
         struct gpio_desc *desc;
         int gpio;
 
-        desc = gpiod_get_index(dev, KBUILD_MODNAME, acpi_index);
+        desc = gpiod_get_index(dev, KBUILD_MODNAME, acpi_index, GPIOD_ASIS);
         if (IS_ERR(desc))
                 return PTR_ERR(desc);
 
diff --git a/drivers/input/misc/twl4030-pwrbutton.c b/drivers/input/misc/twl4030-pwrbutton.c
index fb3b63b2f85c..8400a1a34d87 100644
--- a/drivers/input/misc/twl4030-pwrbutton.c
+++ b/drivers/input/misc/twl4030-pwrbutton.c
@@ -85,6 +85,7 @@ static int twl4030_pwrbutton_probe(struct platform_device *pdev)
         }
 
         platform_set_drvdata(pdev, pwr);
+        device_init_wakeup(&pdev->dev, true);
 
         return 0;
 }
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 2b0ae8cc8e51..d125a019383f 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -1156,7 +1156,13 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
 {
         struct alps_data *priv = psmouse->private;
 
-        if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
+        /*
+         * Check if we are dealing with a bare PS/2 packet, presumably from
+         * a device connected to the external PS/2 port. Because bare PS/2
+         * protocol does not have enough constant bits to self-synchronize
+         * properly we only do this if the device is fully synchronized.
+         */
+        if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
                 if (psmouse->pktcnt == 3) {
                         alps_report_bare_ps2_packet(psmouse, psmouse->packet,
                                                     true);
@@ -1180,12 +1186,27 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
         }
 
         /* Bytes 2 - pktsize should have 0 in the highest bit */
-        if ((priv->proto_version < ALPS_PROTO_V5) &&
+        if (priv->proto_version < ALPS_PROTO_V5 &&
             psmouse->pktcnt >= 2 && psmouse->pktcnt <= psmouse->pktsize &&
             (psmouse->packet[psmouse->pktcnt - 1] & 0x80)) {
                 psmouse_dbg(psmouse, "refusing packet[%i] = %x\n",
                             psmouse->pktcnt - 1,
                             psmouse->packet[psmouse->pktcnt - 1]);
+
+                if (priv->proto_version == ALPS_PROTO_V3 &&
+                    psmouse->pktcnt == psmouse->pktsize) {
+                        /*
+                         * Some Dell boxes, such as Latitude E6440 or E7440
+                         * with closed lid, quite often smash last byte of
+                         * otherwise valid packet with 0xff. Given that the
+                         * next packet is very likely to be valid let's
+                         * report PSMOUSE_FULL_PACKET but not process data,
+                         * rather than reporting PSMOUSE_BAD_DATA and
+                         * filling the logs.
+                         */
+                        return PSMOUSE_FULL_PACKET;
+                }
+
                 return PSMOUSE_BAD_DATA;
         }
 
@@ -2389,6 +2410,9 @@ int alps_init(struct psmouse *psmouse)
         /* We are having trouble resyncing ALPS touchpads so disable it for now */
         psmouse->resync_time = 0;
 
+        /* Allow 2 invalid packets without resetting device */
+        psmouse->resetafter = psmouse->pktsize * 2;
+
         return 0;
 
 init_fail:
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index 06fc6e76ffbe..3fcb6b3cb0bd 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -563,6 +563,7 @@ static void elantech_input_sync_v4(struct psmouse *psmouse)
         } else {
                 input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
                 input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
+                input_report_key(dev, BTN_MIDDLE, packet[0] & 0x04);
         }
 
         input_mt_report_pointer_emulation(dev, true);
@@ -792,6 +793,9 @@ static int elantech_packet_check_v4(struct psmouse *psmouse)
         unsigned char packet_type = packet[3] & 0x03;
         bool sanity_check;
 
+        if ((packet[3] & 0x0f) == 0x06)
+                return PACKET_TRACKPOINT;
+
         /*
          * Sanity check based on the constant bits of a packet.
          * The constant bits change depending on the value of
@@ -877,10 +881,19 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
 
         case 4:
                 packet_type = elantech_packet_check_v4(psmouse);
-                if (packet_type == PACKET_UNKNOWN)
+                switch (packet_type) {
+                case PACKET_UNKNOWN:
                         return PSMOUSE_BAD_DATA;
 
-                elantech_report_absolute_v4(psmouse, packet_type);
+                case PACKET_TRACKPOINT:
+                        elantech_report_trackpoint(psmouse, packet_type);
+                        break;
+
+                default:
+                        elantech_report_absolute_v4(psmouse, packet_type);
+                        break;
+                }
+
                 break;
         }
 
@@ -1120,6 +1133,22 @@ static void elantech_set_buttonpad_prop(struct psmouse *psmouse)
 }
 
 /*
+ * Some hw_version 4 models do have a middle button
+ */
+static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Fujitsu H730 has a middle button */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+                },
+        },
+#endif
+        { }
+};
+
+/*
  * Set the appropriate event bits for the input subsystem
  */
 static int elantech_set_input_params(struct psmouse *psmouse)
@@ -1138,6 +1167,8 @@ static int elantech_set_input_params(struct psmouse *psmouse)
         __clear_bit(EV_REL, dev->evbit);
 
         __set_bit(BTN_LEFT, dev->keybit);
+        if (dmi_check_system(elantech_dmi_has_middle_button))
+                __set_bit(BTN_MIDDLE, dev->keybit);
         __set_bit(BTN_RIGHT, dev->keybit);
 
         __set_bit(BTN_TOUCH, dev->keybit);
@@ -1299,6 +1330,7 @@ ELANTECH_INT_ATTR(reg_25, 0x25);
 ELANTECH_INT_ATTR(reg_26, 0x26);
 ELANTECH_INT_ATTR(debug, 0);
 ELANTECH_INT_ATTR(paritycheck, 0);
+ELANTECH_INT_ATTR(crc_enabled, 0);
 
 static struct attribute *elantech_attrs[] = {
         &psmouse_attr_reg_07.dattr.attr,
@@ -1313,6 +1345,7 @@ static struct attribute *elantech_attrs[] = {
         &psmouse_attr_reg_26.dattr.attr,
         &psmouse_attr_debug.dattr.attr,
         &psmouse_attr_paritycheck.dattr.attr,
+        &psmouse_attr_crc_enabled.dattr.attr,
         NULL
 };
 
@@ -1439,6 +1472,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
 }
 
 /*
+ * Some hw_version 4 models do not work with crc_disabled
+ */
+static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+        {
+                /* Fujitsu H730 does not work with crc_enabled == 0 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H730"),
+                },
+        },
+#endif
+        { }
+};
+
+/*
  * Some hw_version 3 models go into error state when we try to set
  * bit 3 and/or bit 1 of r10.
  */
@@ -1513,7 +1562,8 @@ static int elantech_set_properties(struct elantech_data *etd)
          * The signatures of v3 and v4 packets change depending on the
          * value of this hardware flag.
          */
-        etd->crc_enabled = ((etd->fw_version & 0x4000) == 0x4000);
+        etd->crc_enabled = (etd->fw_version & 0x4000) == 0x4000 ||
+                           dmi_check_system(elantech_dmi_force_crc_enabled);
 
         /* Enable real hardware resolution on hw_version 3 ? */
         etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 26994f6a2b2a..95a3a6e2faf6 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1536,16 +1536,9 @@ static int psmouse_reconnect(struct serio *serio)
 {
         struct psmouse *psmouse = serio_get_drvdata(serio);
         struct psmouse *parent = NULL;
-        struct serio_driver *drv = serio->drv;
         unsigned char type;
         int rc = -1;
 
-        if (!drv || !psmouse) {
-                psmouse_dbg(psmouse,
-                            "reconnect request, but serio is disconnected, ignoring...\n");
-                return -1;
-        }
-
         mutex_lock(&psmouse_mutex);
 
         if (serio->parent && serio->id.type == SERIO_PS_PSTHRU) {
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 9031a0a28ea4..2a7a9174c702 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -135,8 +135,8 @@ static const struct min_max_quirk min_max_pnpid_table[] = {
                 1232, 5710, 1156, 4696
         },
         {
-                (const char * const []){"LEN0034", "LEN0036", "LEN2002",
-                                        "LEN2004", NULL},
+                (const char * const []){"LEN0034", "LEN0036", "LEN0039",
+                                        "LEN2002", "LEN2004", NULL},
                 1024, 5112, 2024, 4832
         },
         {
@@ -163,6 +163,7 @@ static const char * const topbuttonpad_pnp_ids[] = {
         "LEN0036", /* T440 */
         "LEN0037",
         "LEN0038",
+        "LEN0039", /* T440s */
         "LEN0041",
         "LEN0042", /* Yoga */
         "LEN0045",
diff --git a/drivers/input/mouse/vsxxxaa.c b/drivers/input/mouse/vsxxxaa.c
index 38298232124f..abd494411e69 100644
--- a/drivers/input/mouse/vsxxxaa.c
+++ b/drivers/input/mouse/vsxxxaa.c
@@ -128,7 +128,7 @@ static void vsxxxaa_drop_bytes(struct vsxxxaa *mouse, int num)
         if (num >= mouse->count) {
                 mouse->count = 0;
         } else {
-                memmove(mouse->buf, mouse->buf + num - 1, BUFLEN - num);
+                memmove(mouse->buf, mouse->buf + num, BUFLEN - num);
                 mouse->count -= num;
         }
 }
diff --git a/drivers/input/serio/altera_ps2.c b/drivers/input/serio/altera_ps2.c
index cce69d6b9587..58781c8a8aec 100644
--- a/drivers/input/serio/altera_ps2.c
+++ b/drivers/input/serio/altera_ps2.c
@@ -37,7 +37,7 @@ static irqreturn_t altera_ps2_rxint(int irq, void *dev_id)
 {
         struct ps2if *ps2if = dev_id;
         unsigned int status;
-        int handled = IRQ_NONE;
+        irqreturn_t handled = IRQ_NONE;
 
         while ((status = readl(ps2if->base)) & 0xffff0000) {
                 serio_interrupt(ps2if->io, status & 0xff, 0);
@@ -74,7 +74,7 @@ static void altera_ps2_close(struct serio *io)
 {
         struct ps2if *ps2if = io->port_data;
 
-        writel(0, ps2if->base); /* disable rx irq */
+        writel(0, ps2if->base + 4); /* disable rx irq */
 }
 
 /*
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index a0bcbb64d06d..faeeb1372462 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -207,17 +207,282 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
 };
 
 /*
- * Some laptops do implement active multiplexing mode correctly;
- * unfortunately they are in minority.
+ * Some Fujitsu notebooks are having trouble with touchpads if
+ * active multiplexing mode is activated. Luckily they don't have
+ * external PS/2 ports so we can safely disable it.
+ * ... apparently some Toshibas don't like MUX mode either and
+ * die horrible death on reboot.
  */
-static const struct dmi_system_id __initconst i8042_dmi_mux_table[] = {
+static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+        {
+                /* Fujitsu Lifebook P7010/P7010D */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "P7010"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook P7010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "0000000000"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook P5020D */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook P Series"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook S2000 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S Series"),
+                },
+        },
+        {
+                /* Fujitsu Lifebook S6230 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook S6230"),
+                },
+        },
+        {
+                /* Fujitsu T70H */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "FMVLT70H"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Lifebook T3010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK T3010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Lifebook E4010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E4010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Amilo Pro 2010 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Pro V2010"),
+                },
+        },
+        {
+                /* Fujitsu-Siemens Amilo Pro 2030 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO PRO V2030"),
+                },
+        },
+        {
+                /*
+                 * No data is coming from the touchscreen unless KBC
+                 * is in legacy mode.
+                 */
+                /* Panasonic CF-29 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Matsushita"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "CF-29"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion DV4017EA -
+                 * errors on MUX ports are reported without raising AUXDATA
+                 * causing "spurious NAK" messages.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EA032EA#ABF)"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion ZT1000 -
+                 * like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Notebook PC"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "HP Pavilion Notebook ZT1000"),
+                },
+        },
+        {
+                /*
+                 * HP Pavilion DV4270ca -
+                 * like DV4017EA does not raise AUXERR for errors on MUX ports.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Pavilion dv4000 (EH476UA#ABL)"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P10"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "EQUIUM A110"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE C850D"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ALIENWARE"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Sentia"),
+                },
+        },
+        {
+                /* Sharp Actius MM20 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-MM20 Series"),
+                },
+        },
+        {
+                /* Sony Vaio FS-115b */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FS115B"),
+                },
+        },
+        {
+                /*
+                 * Sony Vaio FZ-240E -
+                 * reset and GET ID commands issued via KBD port are
+                 * sometimes being delivered to AUX3.
+                 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "VGN-FZ240E"),
+                },
+        },
         {
                 /*
-                 * Panasonic CF-18 needs to be in MUX mode since the
-                 * touchscreen is on serio3 and it also has touchpad.
+                 * Most (all?) VAIOs do not have external PS/2 ports nor
+                 * they implement active multiplexing properly, and
+                 * MUX discovery usually messes up keyboard/touchpad.
                  */
                 .matches = {
-                        DMI_MATCH(DMI_PRODUCT_NAME, "CF-18"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                        DMI_MATCH(DMI_BOARD_NAME, "VAIO"),
+                },
+        },
+        {
+                /* Amoi M636/A737 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Amoi Electronics CO.,LTD."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "M636/A737 platform"),
+                },
+        },
+        {
+                /* Lenovo 3000 n100 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "076804U"),
+                },
+        },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
+                },
+        },
+        {
+                /* Acer Aspire 5710 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5710"),
+                },
+        },
+        {
+                /* Gericom Bellagio */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "N34AS6"),
+                },
+        },
+        {
+                /* IBM 2656 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "2656"),
+                },
+        },
+        {
+                /* Dell XPS M1530 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS M1530"),
+                },
+        },
+        {
+                /* Compal HEL80I */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "COMPAL"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HEL80I"),
+                },
+        },
+        {
+                /* Dell Vostro 1510 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
+                },
+        },
+        {
+                /* Acer Aspire 5536 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+                },
+        },
+        {
+                /* Dell Vostro V13 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
+                },
+        },
+        {
+                /* Newer HP Pavilion dv4 models */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+                },
+        },
+        {
+                /* Asus X450LCP */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X450LCP"),
+                },
+        },
+        {
+                /* Avatar AVIU-145A6 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
                 },
         },
         { }
@@ -364,6 +629,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
                 },
         },
         {
+                /* Fujitsu A544 laptop */
+                /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"),
+                },
+        },
+        {
+                /* Fujitsu AH544 laptop */
+                /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
+                },
+        },
+        {
                 /* Fujitsu U574 laptop */
                 /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
                 .matches = {
@@ -740,8 +1021,8 @@ static int __init i8042_platform_init(void)
         if (dmi_check_system(i8042_dmi_noloop_table))
                 i8042_noloop = true;
 
-        if (dmi_check_system(i8042_dmi_mux_table))
-                i8042_nomux = false;
+        if (dmi_check_system(i8042_dmi_nomux_table))
+                i8042_nomux = true;
 
         if (dmi_check_system(i8042_dmi_notimeout_table))
                 i8042_notimeout = true;
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 9a97c2b10926..f5a98af3b325 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -39,7 +39,7 @@ static bool i8042_noaux;
 module_param_named(noaux, i8042_noaux, bool, 0);
 MODULE_PARM_DESC(noaux, "Do not probe or use AUX (mouse) port.");
 
-static bool i8042_nomux = true;
+static bool i8042_nomux;
 module_param_named(nomux, i8042_nomux, bool, 0);
 MODULE_PARM_DESC(nomux, "Do not check whether an active multiplexing controller is present.");
 
diff --git a/drivers/input/touchscreen/wm97xx-core.c b/drivers/input/touchscreen/wm97xx-core.c
index d0ef91fc87d1..b1ae77995968 100644
--- a/drivers/input/touchscreen/wm97xx-core.c
+++ b/drivers/input/touchscreen/wm97xx-core.c
@@ -70,11 +70,11 @@
  * Documentation/input/input-programming.txt for more details.
  */
 
-static int abs_x[3] = {350, 3900, 5};
+static int abs_x[3] = {150, 4000, 5};
 module_param_array(abs_x, int, NULL, 0);
 MODULE_PARM_DESC(abs_x, "Touchscreen absolute X min, max, fuzz");
 
-static int abs_y[3] = {320, 3750, 40};
+static int abs_y[3] = {200, 4000, 40};
 module_param_array(abs_y, int, NULL, 0);
 MODULE_PARM_DESC(abs_y, "Touchscreen absolute Y min, max, fuzz");
 
diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
index 3e238cd049e6..6a2e168c3ab0 100644
--- a/drivers/irqchip/irq-armada-370-xp.c
+++ b/drivers/irqchip/irq-armada-370-xp.c
@@ -43,6 +43,7 @@
 #define ARMADA_370_XP_INT_CLEAR_ENABLE_OFFS     (0x34)
 #define ARMADA_370_XP_INT_SOURCE_CTL(irq)       (0x100 + irq*4)
 #define ARMADA_370_XP_INT_SOURCE_CPU_MASK       0xF
+#define ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid)   ((BIT(0) | BIT(8)) << cpuid)
 
 #define ARMADA_370_XP_CPU_INTACK_OFFS           (0x44)
 #define ARMADA_375_PPI_CAUSE                    (0x10)
@@ -406,19 +407,29 @@ static void armada_370_xp_mpic_handle_cascade_irq(unsigned int irq,
                                                   struct irq_desc *desc)
 {
         struct irq_chip *chip = irq_get_chip(irq);
-        unsigned long irqmap, irqn;
+        unsigned long irqmap, irqn, irqsrc, cpuid;
         unsigned int cascade_irq;
 
         chained_irq_enter(chip, desc);
 
         irqmap = readl_relaxed(per_cpu_int_base + ARMADA_375_PPI_CAUSE);
-
-        if (irqmap & BIT(0)) {
-                armada_370_xp_handle_msi_irq(NULL, true);
-                irqmap &= ~BIT(0);
-        }
+        cpuid = cpu_logical_map(smp_processor_id());
 
         for_each_set_bit(irqn, &irqmap, BITS_PER_LONG) {
+                irqsrc = readl_relaxed(main_int_base +
+                                       ARMADA_370_XP_INT_SOURCE_CTL(irqn));
+
+                /* Check if the interrupt is not masked on current CPU.
+                 * Test IRQ (0-1) and FIQ (8-9) mask bits.
+                 */
+                if (!(irqsrc & ARMADA_370_XP_INT_IRQ_FIQ_MASK(cpuid)))
+                        continue;
+
+                if (irqn == 1) {
+                        armada_370_xp_handle_msi_irq(NULL, true);
+                        continue;
+                }
+
                 cascade_irq = irq_find_mapping(armada_370_xp_mpic_domain, irqn);
                 generic_handle_irq(cascade_irq);
         }
diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
index 825ca1f87639..afe79719ea32 100644
--- a/drivers/md/dm-bufio.c
+++ b/drivers/md/dm-bufio.c
@@ -1434,9 +1434,9 @@ static void drop_buffers(struct dm_bufio_client *c)
 
 /*
  * Test if the buffer is unused and too old, and commit it.
- * At if noio is set, we must not do any I/O because we hold
- * dm_bufio_clients_lock and we would risk deadlock if the I/O gets rerouted to
- * different bufio client.
+ * And if GFP_NOFS is used, we must not do any I/O because we hold
+ * dm_bufio_clients_lock and we would risk deadlock if the I/O gets
+ * rerouted to different bufio client.
  */
 static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
                                 unsigned long max_jiffies)
@@ -1444,7 +1444,7 @@ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
         if (jiffies - b->last_accessed < max_jiffies)
                 return 0;
 
-        if (!(gfp & __GFP_IO)) {
+        if (!(gfp & __GFP_FS)) {
                 if (test_bit(B_READING, &b->state) ||
                     test_bit(B_WRITING, &b->state) ||
                     test_bit(B_DIRTY, &b->state))
@@ -1486,7 +1486,7 @@ dm_bufio_shrink_scan(struct shrinker *shrink, struct shrink_control *sc)
         unsigned long freed;
 
         c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (sc->gfp_mask & __GFP_IO)
+        if (sc->gfp_mask & __GFP_FS)
                 dm_bufio_lock(c);
         else if (!dm_bufio_trylock(c))
                 return SHRINK_STOP;
@@ -1503,7 +1503,7 @@ dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc)
         unsigned long count;
 
         c = container_of(shrink, struct dm_bufio_client, shrinker);
-        if (sc->gfp_mask & __GFP_IO)
+        if (sc->gfp_mask & __GFP_FS)
                 dm_bufio_lock(c);
         else if (!dm_bufio_trylock(c))
                 return 0;
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 4857fa4a5484..07c0fa0fa284 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -789,8 +789,7 @@ struct dm_raid_superblock {
         __le32 layout;
         __le32 stripe_sectors;
 
-        __u8 pad[452];          /* Round struct to 512 bytes. */
-                                /* Always set to 0 when writing. */
+        /* Remainder of a logical block is zero-filled when writing (see super_sync()). */
 } __packed;
 
 static int read_disk_sb(struct md_rdev *rdev, int size)
@@ -827,7 +826,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
                     test_bit(Faulty, &(rs->dev[i].rdev.flags)))
                         failed_devices |= (1ULL << i);
 
-        memset(sb, 0, sizeof(*sb));
+        memset(sb + 1, 0, rdev->sb_size - sizeof(*sb));
 
         sb->magic = cpu_to_le32(DM_RAID_MAGIC);
         sb->features = cpu_to_le32(0);  /* No features yet */
@@ -862,7 +861,11 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
         uint64_t events_sb, events_refsb;
 
         rdev->sb_start = 0;
-        rdev->sb_size = sizeof(*sb);
+        rdev->sb_size = bdev_logical_block_size(rdev->meta_bdev);
+        if (rdev->sb_size < sizeof(*sb) || rdev->sb_size > PAGE_SIZE) {
+                DMERR("superblock size of a logical block is no longer valid");
+                return -EINVAL;
+        }
 
         ret = read_disk_sb(rdev, rdev->sb_size);
         if (ret)
@@ -1169,8 +1172,12 @@ static void configure_discard_support(struct dm_target *ti, struct raid_set *rs)
         raid456 = (rs->md.level == 4 || rs->md.level == 5 || rs->md.level == 6);
 
         for (i = 0; i < rs->md.raid_disks; i++) {
-                struct request_queue *q = bdev_get_queue(rs->dev[i].rdev.bdev);
+                struct request_queue *q;
+
+                if (!rs->dev[i].rdev.bdev)
+                        continue;
 
+                q = bdev_get_queue(rs->dev[i].rdev.bdev);
                 if (!q || !blk_queue_discard(q))
                         return;
 
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index d1600d2aa2e2..f8b37d4c05d8 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -159,8 +159,10 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
                 sc->stripes_shift = __ffs(stripes);
 
         r = dm_set_target_max_io_len(ti, chunk_size);
-        if (r)
+        if (r) {
+                kfree(sc);
                 return r;
+        }
 
         ti->num_flush_bios = stripes;
         ti->num_discard_bios = stripes;
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 4843801173fe..0f86d802b533 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1936,6 +1936,14 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                 return DM_MAPIO_SUBMITTED;
         }
 
+        /*
+         * We must hold the virtual cell before doing the lookup, otherwise
+         * there's a race with discard.
+         */
+        build_virtual_key(tc->td, block, &key);
+        if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
+                return DM_MAPIO_SUBMITTED;
+
         r = dm_thin_find_block(td, block, 0, &result);
 
         /*
@@ -1959,13 +1967,10 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                          * shared flag will be set in their case.
                          */
                         thin_defer_bio(tc, bio);
+                        cell_defer_no_holder_no_free(tc, &cell1);
                         return DM_MAPIO_SUBMITTED;
                 }
 
-                build_virtual_key(tc->td, block, &key);
-                if (dm_bio_detain(tc->pool->prison, &key, bio, &cell1, &cell_result))
-                        return DM_MAPIO_SUBMITTED;
-
                 build_data_key(tc->td, result.block, &key);
                 if (dm_bio_detain(tc->pool->prison, &key, bio, &cell2, &cell_result)) {
                         cell_defer_no_holder_no_free(tc, &cell1);
@@ -1986,6 +1991,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                          * of doing so.
                          */
                         handle_unserviceable_bio(tc->pool, bio);
+                        cell_defer_no_holder_no_free(tc, &cell1);
                         return DM_MAPIO_SUBMITTED;
                 }
                 /* fall through */
@@ -1996,6 +2002,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                  * provide the hint to load the metadata into cache.
                  */
                 thin_defer_bio(tc, bio);
+                cell_defer_no_holder_no_free(tc, &cell1);
                 return DM_MAPIO_SUBMITTED;
 
         default:
@@ -2005,6 +2012,7 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
                  * pool is switched to fail-io mode.
                  */
                 bio_io_error(bio);
+                cell_defer_no_holder_no_free(tc, &cell1);
                 return DM_MAPIO_SUBMITTED;
         }
 }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 4dfa15da9cb8..9233c71138f1 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5121,6 +5121,7 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 printk("md: %s still in use.\n",mdname(mddev));
                 if (did_freeze) {
                         clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         md_wakeup_thread(mddev->thread);
                 }
                 err = -EBUSY;
@@ -5135,6 +5136,8 @@ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
                 mddev->ro = 1;
                 set_disk_ro(mddev->gendisk, 1);
                 clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+                md_wakeup_thread(mddev->thread);
                 sysfs_notify_dirent_safe(mddev->sysfs_state);
                 err = 0;
         }
@@ -5178,6 +5181,7 @@ static int do_md_stop(struct mddev *mddev, int mode,
                 mutex_unlock(&mddev->open_mutex);
                 if (did_freeze) {
                         clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                        set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                         md_wakeup_thread(mddev->thread);
                 }
                 return -EBUSY;
diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
index 37d367bb9aa8..bf2b80d5c470 100644
--- a/drivers/md/persistent-data/dm-btree-internal.h
+++ b/drivers/md/persistent-data/dm-btree-internal.h
@@ -42,6 +42,12 @@ struct btree_node {
 } __packed;
 
 
+/*
+ * Locks a block using the btree node validator.
+ */
+int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+                 struct dm_block **result);
+
 void inc_children(struct dm_transaction_manager *tm, struct btree_node *n,
                   struct dm_btree_value_type *vt);
 
diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c
index cf9fd676ae44..1b5e13ec7f96 100644
--- a/drivers/md/persistent-data/dm-btree-spine.c
+++ b/drivers/md/persistent-data/dm-btree-spine.c
@@ -92,7 +92,7 @@ struct dm_block_validator btree_node_validator = {
 
 /*----------------------------------------------------------------*/
 
-static int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
+int bn_read_lock(struct dm_btree_info *info, dm_block_t b,
                  struct dm_block **result)
 {
         return dm_tm_read_lock(info->tm, b, &btree_node_validator, result);
diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
index 416060c25709..200ac12a1d40 100644
--- a/drivers/md/persistent-data/dm-btree.c
+++ b/drivers/md/persistent-data/dm-btree.c
@@ -847,22 +847,26 @@ EXPORT_SYMBOL_GPL(dm_btree_find_lowest_key);
  * FIXME: We shouldn't use a recursive algorithm when we have limited stack
  * space.  Also this only works for single level trees.
  */
-static int walk_node(struct ro_spine *s, dm_block_t block,
+static int walk_node(struct dm_btree_info *info, dm_block_t block,
                      int (*fn)(void *context, uint64_t *keys, void *leaf),
                      void *context)
 {
         int r;
         unsigned i, nr;
+        struct dm_block *node;
         struct btree_node *n;
         uint64_t keys;
 
-        r = ro_step(s, block);
-        n = ro_node(s);
+        r = bn_read_lock(info, block, &node);
+        if (r)
+                return r;
+
+        n = dm_block_data(node);
 
         nr = le32_to_cpu(n->header.nr_entries);
         for (i = 0; i < nr; i++) {
                 if (le32_to_cpu(n->header.flags) & INTERNAL_NODE) {
-                        r = walk_node(s, value64(n, i), fn, context);
+                        r = walk_node(info, value64(n, i), fn, context);
                         if (r)
                                 goto out;
                 } else {
@@ -874,7 +878,7 @@ static int walk_node(struct ro_spine *s, dm_block_t block,
         }
 
 out:
-        ro_pop(s);
+        dm_tm_unlock(info->tm, node);
         return r;
 }
 
@@ -882,15 +886,7 @@ int dm_btree_walk(struct dm_btree_info *info, dm_block_t root,
                   int (*fn)(void *context, uint64_t *keys, void *leaf),
                   void *context)
 {
-        int r;
-        struct ro_spine spine;
-
         BUG_ON(info->levels > 1);
-
-        init_ro_spine(&spine, info);
-        r = walk_node(&spine, root, fn, context);
-        exit_ro_spine(&spine);
-
-        return r;
+        return walk_node(info, root, fn, context);
 }
 EXPORT_SYMBOL_GPL(dm_btree_walk);
diff --git a/drivers/media/common/saa7146/saa7146_core.c b/drivers/media/common/saa7146/saa7146_core.c
index 97afee672d07..4418119cf707 100644
--- a/drivers/media/common/saa7146/saa7146_core.c
+++ b/drivers/media/common/saa7146/saa7146_core.c
@@ -364,6 +364,9 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
                 goto out;
         }
 
+        /* create a nice device name */
+        sprintf(dev->name, "saa7146 (%d)", saa7146_num);
+
         DEB_EE("pci:%p\n", pci);
 
         err = pci_enable_device(pci);
@@ -438,9 +441,6 @@ static int saa7146_init_one(struct pci_dev *pci, const struct pci_device_id *ent
 
         /* the rest + print status message */
 
-        /* create a nice device name */
-        sprintf(dev->name, "saa7146 (%d)", saa7146_num);
-
         pr_info("found saa7146 @ mem %p (revision %d, irq %d) (0x%04x,0x%04x)\n",
                 dev->mem, dev->revision, pci->irq,
                 pci->subsystem_vendor, pci->subsystem_device);
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index b8579ee68bd6..2cf30576bf39 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -962,6 +962,11 @@ static int dvb_frontend_clear_cache(struct dvb_frontend *fe)
         case SYS_ATSC:
                 c->modulation = VSB_8;
                 break;
+        case SYS_ISDBS:
+                c->symbol_rate = 28860000;
+                c->rolloff = ROLLOFF_35;
+                c->bandwidth_hz = c->symbol_rate / 100 * 135;
+                break;
         default:
                 c->modulation = QAM_AUTO;
                 break;
@@ -2072,6 +2077,7 @@ static int dtv_set_frontend(struct dvb_frontend *fe)
                 break;
         case SYS_DVBS:
         case SYS_TURBO:
+        case SYS_ISDBS:
                 rolloff = 135;
                 break;
         case SYS_DVBS2:
diff --git a/drivers/media/dvb-frontends/ds3000.c b/drivers/media/dvb-frontends/ds3000.c
index 335daeff91b9..9d0d0347758f 100644
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -864,6 +864,13 @@ struct dvb_frontend *ds3000_attach(const struct ds3000_config *config,
         memcpy(&state->frontend.ops, &ds3000_ops,
                         sizeof(struct dvb_frontend_ops));
         state->frontend.demodulator_priv = state;
+
+        /*
+         * Some devices like T480 starts with voltage on. Be sure
+         * to turn voltage off during init, as this can otherwise
+         * interfere with Unicable SCR systems.
+         */
+        ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF);
         return &state->frontend;
 
 error3:
diff --git a/drivers/media/dvb-frontends/sp2.c b/drivers/media/dvb-frontends/sp2.c
index 9b684d5c8f91..15bf4318cb74 100644
--- a/drivers/media/dvb-frontends/sp2.c
+++ b/drivers/media/dvb-frontends/sp2.c
@@ -266,7 +266,7 @@ int sp2_ci_poll_slot_status(struct dvb_ca_en50221 *en50221,
         return s->status;
 }
 
-int sp2_init(struct sp2 *s)
+static int sp2_init(struct sp2 *s)
 {
         int ret = 0;
         u8 buf;
@@ -348,7 +348,7 @@ err:
         return ret;
 }
 
-int sp2_exit(struct i2c_client *client)
+static int sp2_exit(struct i2c_client *client)
 {
         struct sp2 *s;
 
diff --git a/drivers/media/dvb-frontends/tc90522.c b/drivers/media/dvb-frontends/tc90522.c
index d9905fb52f84..b35d65c9cc05 100644
--- a/drivers/media/dvb-frontends/tc90522.c
+++ b/drivers/media/dvb-frontends/tc90522.c
@@ -216,32 +216,30 @@ static int tc90522s_get_frontend(struct dvb_frontend *fe)
         c->delivery_system = SYS_ISDBS;
 
         layers = 0;
-        ret = reg_read(state, 0xe8, val, 3);
+        ret = reg_read(state, 0xe6, val, 5);
         if (ret == 0) {
-                int slots;
                 u8 v;
 
+                c->stream_id = val[0] << 8 | val[1];
+
                 /* high/single layer */
-                v = (val[0] & 0x70) >> 4;
+                v = (val[2] & 0x70) >> 4;
                 c->modulation = (v == 7) ? PSK_8 : QPSK;
                 c->fec_inner = fec_conv_sat[v];
                 c->layer[0].fec = c->fec_inner;
                 c->layer[0].modulation = c->modulation;
-                c->layer[0].segment_count = val[1] & 0x3f; /* slots */
+                c->layer[0].segment_count = val[3] & 0x3f; /* slots */
 
                 /* low layer */
-                v = (val[0] & 0x07);
+                v = (val[2] & 0x07);
                 c->layer[1].fec = fec_conv_sat[v];
                 if (v == 0)  /* no low layer */
                         c->layer[1].segment_count = 0;
                 else
-                        c->layer[1].segment_count = val[2] & 0x3f; /* slots */
+                        c->layer[1].segment_count = val[4] & 0x3f; /* slots */
                 /* actually, BPSK if v==1, but not defined in fe_modulation_t */
                 c->layer[1].modulation = QPSK;
                 layers = (v > 0) ? 2 : 1;
-
-                slots =  c->layer[0].segment_count +  c->layer[1].segment_count;
-                c->symbol_rate = 28860000 * slots / 48;
         }
 
         /* statistics */
@@ -363,7 +361,7 @@ static int tc90522t_get_frontend(struct dvb_frontend *fe)
                 u8 v;
 
                 c->isdbt_partial_reception = val[0] & 0x01;
-                c->isdbt_sb_mode = (val[0] & 0xc0) == 0x01;
+                c->isdbt_sb_mode = (val[0] & 0xc0) == 0x40;
 
                 /* layer A */
                 v = (val[2] & 0x78) >> 3;
diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index 13734b8c7917..4cb90317ff45 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -1600,6 +1600,7 @@ static int dvb_register(struct cx23885_tsport *port)
                                 break;
 
                         /* attach tuner */
+                        memset(&m88ts2022_config, 0, sizeof(m88ts2022_config));
                         m88ts2022_config.fe = fe0->dvb.frontend;
                         m88ts2022_config.clock = 27000000;
                         memset(&info, 0, sizeof(struct i2c_board_info));
@@ -1635,6 +1636,7 @@ static int dvb_register(struct cx23885_tsport *port)
                 /* port c - terrestrial/cable */
                 case 2:
                         /* attach frontend */
+                        memset(&si2168_config, 0, sizeof(si2168_config));
                         si2168_config.i2c_adapter = &adapter;
                         si2168_config.fe = &fe0->dvb.frontend;
                         si2168_config.ts_mode = SI2168_TS_SERIAL;
@@ -1654,6 +1656,7 @@ static int dvb_register(struct cx23885_tsport *port)
                         port->i2c_client_demod = client_demod;
 
                         /* attach tuner */
+                        memset(&si2157_config, 0, sizeof(si2157_config));
                         si2157_config.fe = fe0->dvb.frontend;
                         memset(&info, 0, sizeof(struct i2c_board_info));
                         strlcpy(info.type, "si2157", I2C_NAME_SIZE);
diff --git a/drivers/media/pci/tw68/Kconfig b/drivers/media/pci/tw68/Kconfig
index 5425ba1e320d..95d5d5202048 100644
--- a/drivers/media/pci/tw68/Kconfig
+++ b/drivers/media/pci/tw68/Kconfig
@@ -1,7 +1,6 @@
 config VIDEO_TW68
         tristate "Techwell tw68x Video For Linux"
         depends on VIDEO_DEV && PCI && VIDEO_V4L2
-        select I2C_ALGOBIT
         select VIDEOBUF2_DMA_SG
         ---help---
           Support for Techwell tw68xx based frame grabber boards.
diff --git a/drivers/media/pci/tw68/tw68-core.c b/drivers/media/pci/tw68/tw68-core.c
index a6fb48cf7aae..63f0b64057cb 100644
--- a/drivers/media/pci/tw68/tw68-core.c
+++ b/drivers/media/pci/tw68/tw68-core.c
@@ -306,7 +306,7 @@ static int tw68_initdev(struct pci_dev *pci_dev,
 
         /* get irq */
         err = devm_request_irq(&pci_dev->dev, pci_dev->irq, tw68_irq,
-                          IRQF_SHARED | IRQF_DISABLED, dev->name, dev);
+                          IRQF_SHARED, dev->name, dev);
         if (err < 0) {
                 pr_err("%s: can't get IRQ %d\n",
                        dev->name, pci_dev->irq);
diff --git a/drivers/media/platform/Kconfig b/drivers/media/platform/Kconfig
index bee9074ebc13..3aac88f1d54a 100644
--- a/drivers/media/platform/Kconfig
+++ b/drivers/media/platform/Kconfig
@@ -166,7 +166,7 @@ config VIDEO_MEM2MEM_DEINTERLACE
 config VIDEO_SAMSUNG_S5P_G2D
         tristate "Samsung S5P and EXYNOS4 G2D 2d graphics accelerator driver"
         depends on VIDEO_DEV && VIDEO_V4L2
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on HAS_DMA
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
@@ -178,7 +178,7 @@ config VIDEO_SAMSUNG_S5P_G2D
 config VIDEO_SAMSUNG_S5P_JPEG
         tristate "Samsung S5P/Exynos3250/Exynos4 JPEG codec driver"
         depends on VIDEO_DEV && VIDEO_V4L2
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on HAS_DMA
         select VIDEOBUF2_DMA_CONTIG
         select V4L2_MEM2MEM_DEV
@@ -189,7 +189,7 @@ config VIDEO_SAMSUNG_S5P_JPEG
 config VIDEO_SAMSUNG_S5P_MFC
         tristate "Samsung S5P MFC Video Codec"
         depends on VIDEO_DEV && VIDEO_V4L2
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on HAS_DMA
         select VIDEOBUF2_DMA_CONTIG
         default n
diff --git a/drivers/media/platform/exynos4-is/Kconfig b/drivers/media/platform/exynos4-is/Kconfig
index 77c951237744..b7b2e472240a 100644
--- a/drivers/media/platform/exynos4-is/Kconfig
+++ b/drivers/media/platform/exynos4-is/Kconfig
@@ -2,7 +2,7 @@
 config VIDEO_SAMSUNG_EXYNOS4_IS
         bool "Samsung S5P/EXYNOS4 SoC series Camera Subsystem driver"
         depends on VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
-        depends on (PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST)
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         depends on OF && COMMON_CLK
         help
           Say Y here to enable camera host interface devices for
diff --git a/drivers/media/platform/exynos4-is/fimc-core.c b/drivers/media/platform/exynos4-is/fimc-core.c
index b70fd996d794..aee92d908e49 100644
--- a/drivers/media/platform/exynos4-is/fimc-core.c
+++ b/drivers/media/platform/exynos4-is/fimc-core.c
@@ -832,6 +832,7 @@ err:
         return -ENXIO;
 }
 
+#if defined(CONFIG_PM_RUNTIME) || defined(CONFIG_PM_SLEEP)
 static int fimc_m2m_suspend(struct fimc_dev *fimc)
 {
         unsigned long flags;
@@ -870,6 +871,7 @@ static int fimc_m2m_resume(struct fimc_dev *fimc)
 
         return 0;
 }
+#endif /* CONFIG_PM_RUNTIME || CONFIG_PM_SLEEP */
 
 static const struct of_device_id fimc_of_match[];
 
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index e525a7c8d885..6fcc7f072ace 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -893,7 +893,7 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result,
                                unsigned long buffer, unsigned long size,
                                struct s5p_jpeg_ctx *ctx)
 {
-        int c, components, notfound;
+        int c, components = 0, notfound;
         unsigned int height, width, word, subsampling = 0;
         long length;
         struct s5p_jpeg_buffer jpeg_buffer;
@@ -2632,6 +2632,7 @@ static int s5p_jpeg_remove(struct platform_device *pdev)
         return 0;
 }
 
+#if defined(CONFIG_PM_RUNTIME) || defined(CONFIG_PM_SLEEP)
 static int s5p_jpeg_runtime_suspend(struct device *dev)
 {
         struct s5p_jpeg *jpeg = dev_get_drvdata(dev);
@@ -2681,7 +2682,9 @@ static int s5p_jpeg_runtime_resume(struct device *dev)
 
         return 0;
 }
+#endif /* CONFIG_PM_RUNTIME || CONFIG_PM_SLEEP */
 
+#ifdef CONFIG_PM_SLEEP
 static int s5p_jpeg_suspend(struct device *dev)
 {
         if (pm_runtime_suspended(dev))
@@ -2697,6 +2700,7 @@ static int s5p_jpeg_resume(struct device *dev)
 
         return s5p_jpeg_runtime_resume(dev);
 }
+#endif
 
 static const struct dev_pm_ops s5p_jpeg_pm_ops = {
         SET_SYSTEM_SLEEP_PM_OPS(s5p_jpeg_suspend, s5p_jpeg_resume)
diff --git a/drivers/media/platform/s5p-tv/Kconfig b/drivers/media/platform/s5p-tv/Kconfig
index a9d56f8936b4..beb180e71ba0 100644
--- a/drivers/media/platform/s5p-tv/Kconfig
+++ b/drivers/media/platform/s5p-tv/Kconfig
@@ -9,7 +9,7 @@
 config VIDEO_SAMSUNG_S5P_TV
         bool "Samsung TV driver for S5P platform"
         depends on PM_RUNTIME
-        depends on PLAT_S5P || ARCH_EXYNOS || COMPILE_TEST
+        depends on ARCH_S5PV210 || ARCH_EXYNOS || COMPILE_TEST
         default n
         ---help---
           Say Y here to enable selecting the TV output devices for
diff --git a/drivers/media/platform/vivid/Kconfig b/drivers/media/platform/vivid/Kconfig
index d71139a2ae00..c3090932f06d 100644
--- a/drivers/media/platform/vivid/Kconfig
+++ b/drivers/media/platform/vivid/Kconfig
@@ -1,8 +1,11 @@
 config VIDEO_VIVID
         tristate "Virtual Video Test Driver"
-        depends on VIDEO_DEV && VIDEO_V4L2 && !SPARC32 && !SPARC64
+        depends on VIDEO_DEV && VIDEO_V4L2 && !SPARC32 && !SPARC64 && FB
         select FONT_SUPPORT
         select FONT_8x16
+        select FB_CFB_FILLRECT
+        select FB_CFB_COPYAREA
+        select FB_CFB_IMAGEBLIT
         select VIDEOBUF2_VMALLOC
         default n
         ---help---
diff --git a/drivers/media/platform/vivid/vivid-core.c b/drivers/media/platform/vivid/vivid-core.c
index 2c61a62ab48b..686c3c2ad05b 100644
--- a/drivers/media/platform/vivid/vivid-core.c
+++ b/drivers/media/platform/vivid/vivid-core.c
@@ -100,11 +100,9 @@ MODULE_PARM_DESC(ccs_out_mode, " output crop/compose/scale mode:\n"
                            "\t\t    bit 0=crop, 1=compose, 2=scale,\n"
                            "\t\t    -1=user-controlled (default)");
 
-static unsigned multiplanar[VIVID_MAX_DEVS];
+static unsigned multiplanar[VIVID_MAX_DEVS] = { [0 ... (VIVID_MAX_DEVS - 1)] = 1 };
 module_param_array(multiplanar, uint, NULL, 0444);
-MODULE_PARM_DESC(multiplanar, " 0 (default) is alternating single and multiplanar devices,\n"
-                              "\t\t    1 is single planar devices,\n"
-                              "\t\t    2 is multiplanar devices");
+MODULE_PARM_DESC(multiplanar, " 1 (default) creates a single planar device, 2 creates a multiplanar device.");
 
 /* Default: video + vbi-cap (raw and sliced) + radio rx + radio tx + sdr + vbi-out + vid-out */
 static unsigned node_types[VIVID_MAX_DEVS] = { [0 ... (VIVID_MAX_DEVS - 1)] = 0x1d3d };
@@ -669,10 +667,7 @@ static int __init vivid_create_instance(int inst)
         /* start detecting feature set */
 
         /* do we use single- or multi-planar? */
-        if (multiplanar[inst] == 0)
-                dev->multiplanar = inst & 1;
-        else
-                dev->multiplanar = multiplanar[inst] > 1;
+        dev->multiplanar = multiplanar[inst] > 1;
         v4l2_info(&dev->v4l2_dev, "using %splanar format API\n",
                         dev->multiplanar ? "multi" : "single ");
 
diff --git a/drivers/media/platform/vivid/vivid-tpg.c b/drivers/media/platform/vivid/vivid-tpg.c
index 0c6fa53fa646..cbcd6250e7b2 100644
--- a/drivers/media/platform/vivid/vivid-tpg.c
+++ b/drivers/media/platform/vivid/vivid-tpg.c
@@ -136,7 +136,7 @@ int tpg_alloc(struct tpg_data *tpg, unsigned max_w)
                 tpg->black_line[plane] = vzalloc(max_w * pixelsz);
                 if (!tpg->black_line[plane])
                         return -ENOMEM;
-                tpg->random_line[plane] = vzalloc(max_w * pixelsz);
+                tpg->random_line[plane] = vzalloc(max_w * 2 * pixelsz);
                 if (!tpg->random_line[plane])
                         return -ENOMEM;
         }
diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c
index 6f28f6e02ea5..704397f3c106 100644
--- a/drivers/media/radio/wl128x/fmdrv_common.c
+++ b/drivers/media/radio/wl128x/fmdrv_common.c
@@ -1256,7 +1256,7 @@ static int fm_download_firmware(struct fmdev *fmdev, const u8 *fw_name)
                 fmerr("Unable to read firmware(%s) content\n", fw_name);
                 return ret;
         }
-        fmdbg("Firmware(%s) length : %d bytes\n", fw_name, fw_entry->size);
+        fmdbg("Firmware(%s) length : %zu bytes\n", fw_name, fw_entry->size);
 
         fw_data = (void *)fw_entry->data;
         fw_len = fw_entry->size;
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index b8837dd39bb2..65f80b8b9f7a 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -1678,7 +1678,8 @@ static void imon_incoming_packet(struct imon_context *ictx,
                 if (press_type == 0)
                         rc_keyup(ictx->rdev);
                 else {
-                        if (ictx->rc_type == RC_BIT_RC6_MCE)
+                        if (ictx->rc_type == RC_BIT_RC6_MCE ||
+                            ictx->rc_type == RC_BIT_OTHER)
                                 rc_keydown(ictx->rdev,
                                            ictx->rc_type == RC_BIT_RC6_MCE ? RC_TYPE_RC6_MCE : RC_TYPE_OTHER,
                                            ictx->rc_scancode, ictx->rc_toggle);
diff --git a/drivers/media/rc/ir-hix5hd2.c b/drivers/media/rc/ir-hix5hd2.c
index 08bbd4f508cd..b0df62961c14 100644
--- a/drivers/media/rc/ir-hix5hd2.c
+++ b/drivers/media/rc/ir-hix5hd2.c
@@ -297,7 +297,7 @@ static int hix5hd2_ir_remove(struct platform_device *pdev)
         return 0;
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_PM_SLEEP
 static int hix5hd2_ir_suspend(struct device *dev)
 {
         struct hix5hd2_ir_priv *priv = dev_get_drvdata(dev);
diff --git a/drivers/media/rc/ir-rc5-decoder.c b/drivers/media/rc/ir-rc5-decoder.c
index 2ef763928ca4..84fa6e9b59a1 100644
--- a/drivers/media/rc/ir-rc5-decoder.c
+++ b/drivers/media/rc/ir-rc5-decoder.c
@@ -53,7 +53,7 @@ static int ir_rc5_decode(struct rc_dev *dev, struct ir_raw_event ev)
         u32 scancode;
         enum rc_type protocol;
 
-        if (!(dev->enabled_protocols & (RC_BIT_RC5 | RC_BIT_RC5X)))
+        if (!(dev->enabled_protocols & (RC_BIT_RC5 | RC_BIT_RC5X | RC_BIT_RC5_SZ)))
                 return 0;
 
         if (!is_timing_event(ev)) {
diff --git a/drivers/media/rc/rc-ir-raw.c b/drivers/media/rc/rc-ir-raw.c
index e8fff2add265..b732ac6a26d8 100644
--- a/drivers/media/rc/rc-ir-raw.c
+++ b/drivers/media/rc/rc-ir-raw.c
@@ -262,7 +262,6 @@ int ir_raw_event_register(struct rc_dev *dev)
                 return -ENOMEM;
 
         dev->raw->dev = dev;
-        dev->enabled_protocols = ~0;
         dev->change_protocol = change_protocol;
         rc = kfifo_alloc(&dev->raw->kfifo,
                          sizeof(struct ir_raw_event) * MAX_IR_EVENT_SIZE,
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index a7991c7d010a..8d3b74c5a717 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -1421,6 +1421,8 @@ int rc_register_device(struct rc_dev *dev)
 
         if (dev->change_protocol) {
                 u64 rc_type = (1 << rc_map->rc_type);
+                if (dev->driver_type == RC_DRIVER_IR_RAW)
+                        rc_type |= RC_BIT_LIRC;
                 rc = dev->change_protocol(dev, &rc_type);
                 if (rc < 0)
                         goto out_raw;
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
index e44c8aba6074..803a0e63d47e 100644
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -1333,9 +1333,9 @@ static int xc5000_release(struct dvb_frontend *fe)
 
         if (priv) {
                 cancel_delayed_work(&priv->timer_sleep);
-                hybrid_tuner_release_state(priv);
                 if (priv->firmware)
                         release_firmware(priv->firmware);
+                hybrid_tuner_release_state(priv);
         }
 
         mutex_unlock(&xc5000_list_mutex);
diff --git a/drivers/media/usb/dvb-usb-v2/af9035.c b/drivers/media/usb/dvb-usb-v2/af9035.c
index 00758c83eec7..1896ab218b11 100644
--- a/drivers/media/usb/dvb-usb-v2/af9035.c
+++ b/drivers/media/usb/dvb-usb-v2/af9035.c
@@ -193,8 +193,8 @@ static int af9035_wr_reg_mask(struct dvb_usb_device *d, u32 reg, u8 val,
         return af9035_wr_regs(d, reg, &val, 1);
 }
 
-static int af9035_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
-                void *platform_data, struct i2c_adapter *adapter)
+static int af9035_add_i2c_dev(struct dvb_usb_device *d, const char *type,
+                u8 addr, void *platform_data, struct i2c_adapter *adapter)
 {
         int ret, num;
         struct state *state = d_to_priv(d);
@@ -221,7 +221,7 @@ static int af9035_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
                 goto err;
         }
 
-        request_module(board_info.type);
+        request_module("%s", board_info.type);
 
         /* register I2C device */
         client = i2c_new_device(adapter, &board_info);
diff --git a/drivers/media/usb/dvb-usb-v2/anysee.c b/drivers/media/usb/dvb-usb-v2/anysee.c
index d3c5f230e97a..ae917c042a52 100644
--- a/drivers/media/usb/dvb-usb-v2/anysee.c
+++ b/drivers/media/usb/dvb-usb-v2/anysee.c
@@ -630,8 +630,8 @@ error:
         return ret;
 }
 
-static int anysee_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
-                void *platform_data)
+static int anysee_add_i2c_dev(struct dvb_usb_device *d, const char *type,
+                u8 addr, void *platform_data)
 {
         int ret, num;
         struct anysee_state *state = d_to_priv(d);
@@ -659,7 +659,7 @@ static int anysee_add_i2c_dev(struct dvb_usb_device *d, char *type, u8 addr,
                 goto err;
         }
 
-        request_module(board_info.type);
+        request_module("%s", board_info.type);
 
         /* register I2C device */
         client = i2c_new_device(adapter, &board_info);
diff --git a/drivers/media/usb/em28xx/em28xx-core.c b/drivers/media/usb/em28xx/em28xx-core.c
index b5e52fe7957a..901cf2b952d7 100644
--- a/drivers/media/usb/em28xx/em28xx-core.c
+++ b/drivers/media/usb/em28xx/em28xx-core.c
@@ -504,7 +504,7 @@ EXPORT_SYMBOL_GPL(em28xx_audio_analog_set);
 int em28xx_audio_setup(struct em28xx *dev)
 {
         int vid1, vid2, feat, cfg;
-        u32 vid;
+        u32 vid = 0;
         u8 i2s_samplerates;
 
         if (dev->chip_id == CHIP_ID_EM2870 ||
diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c
index 581f6dad4ca9..23f8f6afa2e0 100644
--- a/drivers/media/usb/em28xx/em28xx-input.c
+++ b/drivers/media/usb/em28xx/em28xx-input.c
@@ -712,8 +712,10 @@ static int em28xx_ir_init(struct em28xx *dev)
         em28xx_info("Registering input extension\n");
 
         ir = kzalloc(sizeof(*ir), GFP_KERNEL);
+        if (!ir)
+                return -ENOMEM;
         rc = rc_allocate_device();
-        if (!ir || !rc)
+        if (!rc)
                 goto error;
 
         /* record handles to ourself */
diff --git a/drivers/media/usb/hackrf/hackrf.c b/drivers/media/usb/hackrf/hackrf.c
index 328b5ba47a0a..fd1fa412e094 100644
--- a/drivers/media/usb/hackrf/hackrf.c
+++ b/drivers/media/usb/hackrf/hackrf.c
@@ -932,7 +932,7 @@ static int hackrf_set_bandwidth(struct hackrf_dev *dev)
         dev->bandwidth->val = bandwidth;
         dev->bandwidth->cur.val = bandwidth;
 
-        dev_dbg(dev->dev, "bandwidth selected=%d\n", bandwidth_lut[i].freq);
+        dev_dbg(dev->dev, "bandwidth selected=%d\n", bandwidth);
 
         u16tmp = 0;
         u16tmp |= ((bandwidth >> 0) & 0xff) << 0;
diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
index 68bc9615660e..9bfa041e3316 100644
--- a/drivers/media/usb/usbvision/usbvision-video.c
+++ b/drivers/media/usb/usbvision/usbvision-video.c
@@ -446,6 +446,7 @@ static int usbvision_v4l2_close(struct file *file)
         if (usbvision->remove_pending) {
                 printk(KERN_INFO "%s: Final disconnect\n", __func__);
                 usbvision_release(usbvision);
+                return 0;
         }
         mutex_unlock(&usbvision->v4l2_lock);
 
@@ -1221,6 +1222,7 @@ static int usbvision_radio_close(struct file *file)
         if (usbvision->remove_pending) {
                 printk(KERN_INFO "%s: Final disconnect\n", __func__);
                 usbvision_release(usbvision);
+                return err_code;
         }
 
         mutex_unlock(&usbvision->v4l2_lock);
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index 60a8e2c3631e..378ae02e593b 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -318,7 +318,6 @@ static int uvc_v4l2_set_format(struct uvc_streaming *stream,
         stream->ctrl = probe;
         stream->cur_format = format;
         stream->cur_frame = frame;
-        stream->frame_size = fmt->fmt.pix.sizeimage;
 
 done:
         mutex_unlock(&stream->mutex);
diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
index 9ace520bb079..df81b9c4faf1 100644
--- a/drivers/media/usb/uvc/uvc_video.c
+++ b/drivers/media/usb/uvc/uvc_video.c
@@ -1143,7 +1143,7 @@ static int uvc_video_encode_data(struct uvc_streaming *stream,
 static void uvc_video_validate_buffer(const struct uvc_streaming *stream,
                                       struct uvc_buffer *buf)
 {
-        if (stream->frame_size != buf->bytesused &&
+        if (stream->ctrl.dwMaxVideoFrameSize != buf->bytesused &&
             !(stream->cur_format->flags & UVC_FMT_FLAG_COMPRESSED))
                 buf->error = 1;
 }
diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h
index 6f676c29ec09..864ada740360 100644
--- a/drivers/media/usb/uvc/uvcvideo.h
+++ b/drivers/media/usb/uvc/uvcvideo.h
@@ -457,7 +457,6 @@ struct uvc_streaming {
         struct uvc_format *def_format;
         struct uvc_format *cur_format;
         struct uvc_frame *cur_frame;
-        size_t frame_size;
 
         /* Protect access to ctrl, cur_format, cur_frame and hardware video
          * probe control.
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
index bf80f0f7dfb8..e02353e340dd 100644
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -305,6 +305,15 @@ static int __videobuf_mmap_mapper(struct videobuf_queue *q,
         /* Try to remap memory */
         size = vma->vm_end - vma->vm_start;
         vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+
+        /* the "vm_pgoff" is just used in v4l2 to find the
+         * corresponding buffer data structure which is allocated
+         * earlier and it does not mean the offset from the physical
+         * buffer start address as usual. So set it to 0 to pass
+         * the sanity check in vm_iomap_memory().
+         */
+        vma->vm_pgoff = 0;
+
         retval = vm_iomap_memory(vma, mem->dma_handle, size);
         if (retval) {
                 dev_err(q->dev, "mmap: remap failed with error %d. ",
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index cf008f45968c..711773e8e64b 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -240,7 +240,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 goto err_irq_charger;
         }
 
-        ret = regmap_add_irq_chip(max77693->regmap, max77693->irq,
+        ret = regmap_add_irq_chip(max77693->regmap_muic, max77693->irq,
                                 IRQF_ONESHOT | IRQF_SHARED |
                                 IRQF_TRIGGER_FALLING, 0,
                                 &max77693_muic_irq_chip,
@@ -250,6 +250,17 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 goto err_irq_muic;
         }
 
+        /* Unmask interrupts from all blocks in interrupt source register */
+        ret = regmap_update_bits(max77693->regmap,
+                                MAX77693_PMIC_REG_INTSRC_MASK,
+                                SRC_IRQ_ALL, (unsigned int)~SRC_IRQ_ALL);
+        if (ret < 0) {
+                dev_err(max77693->dev,
+                        "Could not unmask interrupts in INTSRC: %d\n",
+                        ret);
+                goto err_intsrc;
+        }
+
         pm_runtime_set_active(max77693->dev);
 
         ret = mfd_add_devices(max77693->dev, -1, max77693_devs,
@@ -261,6 +272,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 
 err_mfd:
         mfd_remove_devices(max77693->dev);
+err_intsrc:
         regmap_del_irq_chip(max77693->irq, max77693->irq_data_muic);
 err_irq_muic:
         regmap_del_irq_chip(max77693->irq, max77693->irq_data_charger);
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index f2643c221d34..30f7ca89a0e6 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -947,6 +947,7 @@ static void rtsx_pci_idle_work(struct work_struct *work)
         mutex_unlock(&pcr->pcr_mutex);
 }
 
+#ifdef CONFIG_PM
 static void rtsx_pci_power_off(struct rtsx_pcr *pcr, u8 pm_state)
 {
         if (pcr->ops->turn_off_led)
@@ -961,6 +962,7 @@ static void rtsx_pci_power_off(struct rtsx_pcr *pcr, u8 pm_state)
         if (pcr->ops->force_power_down)
                 pcr->ops->force_power_down(pcr, pm_state);
 }
+#endif
 
 static int rtsx_pci_init_hw(struct rtsx_pcr *pcr)
 {
diff --git a/drivers/mfd/stmpe.h b/drivers/mfd/stmpe.h
index 2d045f26f193..bee0abf82040 100644
--- a/drivers/mfd/stmpe.h
+++ b/drivers/mfd/stmpe.h
@@ -269,7 +269,7 @@ int stmpe_remove(struct stmpe *stmpe);
 #define STMPE24XX_REG_CHIP_ID           0x80
 #define STMPE24XX_REG_IEGPIOR_LSB       0x18
 #define STMPE24XX_REG_ISGPIOR_MSB       0x19
-#define STMPE24XX_REG_GPMR_LSB          0xA5
+#define STMPE24XX_REG_GPMR_LSB          0xA4
 #define STMPE24XX_REG_GPSR_LSB          0x85
 #define STMPE24XX_REG_GPCR_LSB          0x88
 #define STMPE24XX_REG_GPDR_LSB          0x8B
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index cf92a6d1c532..50f9091bcd38 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -44,6 +44,15 @@ static u8 twl4030_start_script_address = 0x2b;
 #define PWR_DEVSLP              BIT(1)
 #define PWR_DEVOFF              BIT(0)
 
+/* Register bits for CFG_P1_TRANSITION (also for P2 and P3) */
+#define STARTON_SWBUG           BIT(7)  /* Start on watchdog */
+#define STARTON_VBUS            BIT(5)  /* Start on VBUS */
+#define STARTON_VBAT            BIT(4)  /* Start on battery insert */
+#define STARTON_RTC             BIT(3)  /* Start on RTC */
+#define STARTON_USB             BIT(2)  /* Start on USB host */
+#define STARTON_CHG             BIT(1)  /* Start on charger */
+#define STARTON_PWON            BIT(0)  /* Start on PWRON button */
+
 #define SEQ_OFFSYNC             (1 << 0)
 
 #define PHY_TO_OFF_PM_MASTER(p)         (p - 0x36)
@@ -606,6 +615,44 @@ twl4030_power_configure_resources(const struct twl4030_power_data *pdata)
         return 0;
 }
 
+static int twl4030_starton_mask_and_set(u8 bitmask, u8 bitvalues)
+{
+        u8 regs[3] = { TWL4030_PM_MASTER_CFG_P1_TRANSITION,
+                       TWL4030_PM_MASTER_CFG_P2_TRANSITION,
+                       TWL4030_PM_MASTER_CFG_P3_TRANSITION, };
+        u8 val;
+        int i, err;
+
+        err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, TWL4030_PM_MASTER_KEY_CFG1,
+                               TWL4030_PM_MASTER_PROTECT_KEY);
+        if (err)
+                goto relock;
+        err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
+                               TWL4030_PM_MASTER_KEY_CFG2,
+                               TWL4030_PM_MASTER_PROTECT_KEY);
+        if (err)
+                goto relock;
+
+        for (i = 0; i < sizeof(regs); i++) {
+                err = twl_i2c_read_u8(TWL_MODULE_PM_MASTER,
+                                      &val, regs[i]);
+                if (err)
+                        break;
+                val = (~bitmask & val) | (bitmask & bitvalues);
+                err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER,
+                                       val, regs[i]);
+                if (err)
+                        break;
+        }
+
+        if (err)
+                pr_err("TWL4030 Register access failed: %i\n", err);
+
+relock:
+        return twl_i2c_write_u8(TWL_MODULE_PM_MASTER, 0,
+                                TWL4030_PM_MASTER_PROTECT_KEY);
+}
+
 /*
  * In master mode, start the power off sequence.
  * After a successful execution, TWL shuts down the power to the SoC
@@ -615,6 +662,11 @@ void twl4030_power_off(void)
 {
         int err;
 
+        /* Disable start on charger or VBUS as it can break poweroff */
+        err = twl4030_starton_mask_and_set(STARTON_VBUS | STARTON_CHG, 0);
+        if (err)
+                pr_err("TWL4030 Unable to configure start-up\n");
+
         err = twl_i2c_write_u8(TWL_MODULE_PM_MASTER, PWR_DEVOFF,
                                TWL4030_PM_MASTER_P1_SW_EVENTS);
         if (err)
diff --git a/drivers/mfd/viperboard.c b/drivers/mfd/viperboard.c
index e00f5340ed87..3c2b8f9e3c84 100644
--- a/drivers/mfd/viperboard.c
+++ b/drivers/mfd/viperboard.c
@@ -93,8 +93,9 @@ static int vprbrd_probe(struct usb_interface *interface,
                  version >> 8, version & 0xff,
                  vb->usb_dev->bus->busnum, vb->usb_dev->devnum);
 
-        ret = mfd_add_devices(&interface->dev, -1, vprbrd_devs,
-                                ARRAY_SIZE(vprbrd_devs), NULL, 0, NULL);
+        ret = mfd_add_devices(&interface->dev, PLATFORM_DEVID_AUTO,
+                                vprbrd_devs, ARRAY_SIZE(vprbrd_devs), NULL, 0,
+                                NULL);
         if (ret != 0) {
                 dev_err(&interface->dev, "Failed to add mfd devices to core.");
                 goto error;
diff --git a/drivers/misc/cxl/fault.c b/drivers/misc/cxl/fault.c
index 69506ebd4d07..c99e896604ee 100644
--- a/drivers/misc/cxl/fault.c
+++ b/drivers/misc/cxl/fault.c
@@ -21,60 +21,64 @@
 
 #include "cxl.h"
 
-static struct cxl_sste* find_free_sste(struct cxl_sste *primary_group,
-                                       bool sec_hash,
-                                       struct cxl_sste *secondary_group,
-                                       unsigned int *lru)
+static bool sste_matches(struct cxl_sste *sste, struct copro_slb *slb)
 {
-        unsigned int i, entry;
-        struct cxl_sste *sste, *group = primary_group;
-
-        for (i = 0; i < 2; i++) {
-                for (entry = 0; entry < 8; entry++) {
-                        sste = group + entry;
-                        if (!(be64_to_cpu(sste->esid_data) & SLB_ESID_V))
-                                return sste;
-                }
-                if (!sec_hash)
-                        break;
-                group = secondary_group;
+        return ((sste->vsid_data == cpu_to_be64(slb->vsid)) &&
+                (sste->esid_data == cpu_to_be64(slb->esid)));
+}
+
+/*
+ * This finds a free SSTE for the given SLB, or returns NULL if it's already in
+ * the segment table.
+ */
+static struct cxl_sste* find_free_sste(struct cxl_context *ctx,
+                                       struct copro_slb *slb)
+{
+        struct cxl_sste *primary, *sste, *ret = NULL;
+        unsigned int mask = (ctx->sst_size >> 7) - 1; /* SSTP0[SegTableSize] */
+        unsigned int entry;
+        unsigned int hash;
+
+        if (slb->vsid & SLB_VSID_B_1T)
+                hash = (slb->esid >> SID_SHIFT_1T) & mask;
+        else /* 256M */
+                hash = (slb->esid >> SID_SHIFT) & mask;
+
+        primary = ctx->sstp + (hash << 3);
+
+        for (entry = 0, sste = primary; entry < 8; entry++, sste++) {
+                if (!ret && !(be64_to_cpu(sste->esid_data) & SLB_ESID_V))
+                        ret = sste;
+                if (sste_matches(sste, slb))
+                        return NULL;
         }
+        if (ret)
+                return ret;
+
         /* Nothing free, select an entry to cast out */
-        if (sec_hash && (*lru & 0x8))
-                sste = secondary_group + (*lru & 0x7);
-        else
-                sste = primary_group + (*lru & 0x7);
-        *lru = (*lru + 1) & 0xf;
+        ret = primary + ctx->sst_lru;
+        ctx->sst_lru = (ctx->sst_lru + 1) & 0x7;
 
-        return sste;
+        return ret;
 }
 
 static void cxl_load_segment(struct cxl_context *ctx, struct copro_slb *slb)
 {
         /* mask is the group index, we search primary and secondary here. */
-        unsigned int mask = (ctx->sst_size >> 7)-1; /* SSTP0[SegTableSize] */
-        bool sec_hash = 1;
         struct cxl_sste *sste;
-        unsigned int hash;
         unsigned long flags;
 
-
-        sec_hash = !!(cxl_p1n_read(ctx->afu, CXL_PSL_SR_An) & CXL_PSL_SR_An_SC);
-
-        if (slb->vsid & SLB_VSID_B_1T)
-                hash = (slb->esid >> SID_SHIFT_1T) & mask;
-        else /* 256M */
-                hash = (slb->esid >> SID_SHIFT) & mask;
-
         spin_lock_irqsave(&ctx->sste_lock, flags);
-        sste = find_free_sste(ctx->sstp + (hash << 3), sec_hash,
-                              ctx->sstp + ((~hash & mask) << 3), &ctx->sst_lru);
+        sste = find_free_sste(ctx, slb);
+        if (!sste)
+                goto out_unlock;
 
         pr_devel("CXL Populating SST[%li]: %#llx %#llx\n",
                         sste - ctx->sstp, slb->vsid, slb->esid);
 
         sste->vsid_data = cpu_to_be64(slb->vsid);
         sste->esid_data = cpu_to_be64(slb->esid);
+out_unlock:
         spin_unlock_irqrestore(&ctx->sste_lock, flags);
 }
 
diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c
index 623286a77114..d47532e8f4f1 100644
--- a/drivers/misc/cxl/native.c
+++ b/drivers/misc/cxl/native.c
@@ -417,7 +417,7 @@ static int attach_afu_directed(struct cxl_context *ctx, u64 wed, u64 amr)
         ctx->elem->haurp = 0; /* disable */
         ctx->elem->sdr = cpu_to_be64(mfspr(SPRN_SDR1));
 
-        sr = CXL_PSL_SR_An_SC;
+        sr = 0;
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
         if (mfspr(SPRN_LPCR) & LPCR_TC)
@@ -508,7 +508,7 @@ static int attach_dedicated(struct cxl_context *ctx, u64 wed, u64 amr)
         u64 sr;
         int rc;
 
-        sr = CXL_PSL_SR_An_SC;
+        sr = 0;
         set_endian(sr);
         if (ctx->master)
                 sr |= CXL_PSL_SR_An_MP;
diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 03c53b72a2d6..270d58a4c43d 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -311,7 +311,8 @@ int mmc_of_parse(struct mmc_host *host)
         struct device_node *np;
         u32 bus_width;
         int len, ret;
-        bool cap_invert, gpio_invert;
+        bool cd_cap_invert, cd_gpio_invert = false;
+        bool ro_cap_invert, ro_gpio_invert = false;
 
         if (!host->parent || !host->parent->of_node)
                 return 0;
@@ -359,16 +360,13 @@ int mmc_of_parse(struct mmc_host *host)
         if (of_find_property(np, "non-removable", &len)) {
                 host->caps |= MMC_CAP_NONREMOVABLE;
         } else {
-                if (of_property_read_bool(np, "cd-inverted"))
-                        cap_invert = true;
-                else
-                        cap_invert = false;
+                cd_cap_invert = of_property_read_bool(np, "cd-inverted");
 
                 if (of_find_property(np, "broken-cd", &len))
                         host->caps |= MMC_CAP_NEEDS_POLL;
 
                 ret = mmc_gpiod_request_cd(host, "cd", 0, true,
-                                           0, &gpio_invert);
+                                           0, &cd_gpio_invert);
                 if (ret) {
                         if (ret == -EPROBE_DEFER)
                                 return ret;
@@ -391,17 +389,14 @@ int mmc_of_parse(struct mmc_host *host)
                  * both inverted, the end result is that the CD line is
                  * not inverted.
                  */
-                if (cap_invert ^ gpio_invert)
+                if (cd_cap_invert ^ cd_gpio_invert)
                         host->caps2 |= MMC_CAP2_CD_ACTIVE_HIGH;
         }
 
         /* Parse Write Protection */
-        if (of_property_read_bool(np, "wp-inverted"))
-                cap_invert = true;
-        else
-                cap_invert = false;
+        ro_cap_invert = of_property_read_bool(np, "wp-inverted");
 
-        ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &gpio_invert);
+        ret = mmc_gpiod_request_ro(host, "wp", 0, false, 0, &ro_gpio_invert);
         if (ret) {
                 if (ret == -EPROBE_DEFER)
                         goto out;
@@ -414,7 +409,7 @@ int mmc_of_parse(struct mmc_host *host)
                 dev_info(host->parent, "Got WP GPIO\n");
 
         /* See the comment on CD inversion above */
-        if (cap_invert ^ gpio_invert)
+        if (ro_cap_invert ^ ro_gpio_invert)
                 host->caps2 |= MMC_CAP2_RO_ACTIVE_HIGH;
 
         if (of_find_property(np, "cap-sd-highspeed", &len))
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a7543ba3e190..3096f3ded3ad 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -2590,6 +2590,8 @@ static void cfi_intelext_resume(struct mtd_info *mtd)
 
                 /* Go to known state. Chip may have been power cycled */
                 if (chip->state == FL_PM_SUSPENDED) {
+                        /* Refresh LH28F640BF Partition Config. Register */
+                        fixup_LH28F640BF(mtd);
                         map_write(map, CMD(0xFF), cfi->chips[i].start);
                         chip->oldstate = chip->state = FL_READY;
                         wake_up(&chip->wq);
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index dcda6287228d..ed827cf894e4 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -193,10 +193,10 @@ static int m25p_probe(struct spi_device *spi)
 {
         struct mtd_part_parser_data     ppdata;
         struct flash_platform_data      *data;
-        const struct spi_device_id *id = NULL;
         struct m25p *flash;
         struct spi_nor *nor;
         enum read_mode mode = SPI_NOR_NORMAL;
+        char *flash_name = NULL;
         int ret;
 
         data = dev_get_platdata(&spi->dev);
@@ -236,13 +236,11 @@ static int m25p_probe(struct spi_device *spi)
          * If that's the case, respect "type" and ignore a "name".
          */
         if (data && data->type)
-                id = spi_nor_match_id(data->type);
+                flash_name = data->type;
+        else
+                flash_name = spi->modalias;
 
-        /* If we didn't get name from platform, simply use "modalias". */
-        if (!id)
-                id = spi_get_device_id(spi);
-
-        ret = spi_nor_scan(nor, id, mode);
+        ret = spi_nor_scan(nor, flash_name, mode);
         if (ret)
                 return ret;
 
@@ -263,12 +261,62 @@ static int m25p_remove(struct spi_device *spi)
 }
 
 
+/*
+ * XXX This needs to be kept in sync with spi_nor_ids.  We can't share
+ * it with spi-nor, because if this is built as a module then modpost
+ * won't be able to read it and add appropriate aliases.
+ */
+static const struct spi_device_id m25p_ids[] = {
+        {"at25fs010"},  {"at25fs040"},  {"at25df041a"}, {"at25df321a"},
+        {"at25df641"},  {"at26f004"},   {"at26df081a"}, {"at26df161a"},
+        {"at26df321"},  {"at45db081d"},
+        {"en25f32"},    {"en25p32"},    {"en25q32b"},   {"en25p64"},
+        {"en25q64"},    {"en25qh128"},  {"en25qh256"},
+        {"f25l32pa"},
+        {"mr25h256"},   {"mr25h10"},
+        {"gd25q32"},    {"gd25q64"},
+        {"160s33b"},    {"320s33b"},    {"640s33b"},
+        {"mx25l2005a"}, {"mx25l4005a"}, {"mx25l8005"},  {"mx25l1606e"},
+        {"mx25l3205d"}, {"mx25l3255e"}, {"mx25l6405d"}, {"mx25l12805d"},
+        {"mx25l12855e"},{"mx25l25635e"},{"mx25l25655e"},{"mx66l51235l"},
+        {"mx66l1g55g"},
+        {"n25q064"},    {"n25q128a11"}, {"n25q128a13"}, {"n25q256a"},
+        {"n25q512a"},   {"n25q512ax3"}, {"n25q00"},
+        {"pm25lv512"},  {"pm25lv010"},  {"pm25lq032"},
+        {"s25sl032p"},  {"s25sl064p"},  {"s25fl256s0"}, {"s25fl256s1"},
+        {"s25fl512s"},  {"s70fl01gs"},  {"s25sl12800"}, {"s25sl12801"},
+        {"s25fl129p0"}, {"s25fl129p1"}, {"s25sl004a"},  {"s25sl008a"},
+        {"s25sl016a"},  {"s25sl032a"},  {"s25sl064a"},  {"s25fl008k"},
+        {"s25fl016k"},  {"s25fl064k"},
+        {"sst25vf040b"},{"sst25vf080b"},{"sst25vf016b"},{"sst25vf032b"},
+        {"sst25vf064c"},{"sst25wf512"}, {"sst25wf010"}, {"sst25wf020"},
+        {"sst25wf040"},
+        {"m25p05"},     {"m25p10"},     {"m25p20"},     {"m25p40"},
+        {"m25p80"},     {"m25p16"},     {"m25p32"},     {"m25p64"},
+        {"m25p128"},    {"n25q032"},
+        {"m25p05-nonjedec"},    {"m25p10-nonjedec"},    {"m25p20-nonjedec"},
+        {"m25p40-nonjedec"},    {"m25p80-nonjedec"},    {"m25p16-nonjedec"},
+        {"m25p32-nonjedec"},    {"m25p64-nonjedec"},    {"m25p128-nonjedec"},
+        {"m45pe10"},    {"m45pe80"},    {"m45pe16"},
+        {"m25pe20"},    {"m25pe80"},    {"m25pe16"},
+        {"m25px16"},    {"m25px32"},    {"m25px32-s0"}, {"m25px32-s1"},
+        {"m25px64"},
+        {"w25x10"},     {"w25x20"},     {"w25x40"},     {"w25x80"},
+        {"w25x16"},     {"w25x32"},     {"w25q32"},     {"w25q32dw"},
+        {"w25x64"},     {"w25q64"},     {"w25q128"},    {"w25q80"},
+        {"w25q80bl"},   {"w25q128"},    {"w25q256"},    {"cat25c11"},
+        {"cat25c03"},   {"cat25c09"},   {"cat25c17"},   {"cat25128"},
+        { },
+};
+MODULE_DEVICE_TABLE(spi, m25p_ids);
+
+
 static struct spi_driver m25p80_driver = {
         .driver = {
                 .name   = "m25p80",
                 .owner  = THIS_MODULE,
         },
-        .id_table       = spi_nor_ids,
+        .id_table       = m25p_ids,
         .probe  = m25p_probe,
         .remove = m25p_remove,
 
diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
index b4f61c7fc161..058531044ceb 100644
--- a/drivers/mtd/nand/omap_elm.c
+++ b/drivers/mtd/nand/omap_elm.c
@@ -115,7 +115,7 @@ int elm_config(struct device *dev, enum bch_ecc bch_type,
 
         if (!info) {
                 dev_err(dev, "Unable to configure elm - device not probed?\n");
-                return -ENODEV;
+                return -EPROBE_DEFER;
         }
         /* ELM cannot detect ECC errors for chunks > 1KB */
         if (ecc_step_size > ((ELM_ECC_SIZE + 1) / 2)) {
diff --git a/drivers/mtd/spi-nor/fsl-quadspi.c b/drivers/mtd/spi-nor/fsl-quadspi.c
index 8d659a2888d5..d5269a26c839 100644
--- a/drivers/mtd/spi-nor/fsl-quadspi.c
+++ b/drivers/mtd/spi-nor/fsl-quadspi.c
@@ -881,7 +881,6 @@ static int fsl_qspi_probe(struct platform_device *pdev)
 
         /* iterate the subnodes. */
         for_each_available_child_of_node(dev->of_node, np) {
-                const struct spi_device_id *id;
                 char modalias[40];
 
                 /* skip the holes */
@@ -909,10 +908,6 @@ static int fsl_qspi_probe(struct platform_device *pdev)
                 if (of_modalias_node(np, modalias, sizeof(modalias)) < 0)
                         goto map_failed;
 
-                id = spi_nor_match_id(modalias);
-                if (!id)
-                        goto map_failed;
-
                 ret = of_property_read_u32(np, "spi-max-frequency",
                                 &q->clk_rate);
                 if (ret < 0)
@@ -921,7 +916,7 @@ static int fsl_qspi_probe(struct platform_device *pdev)
                 /* set the chip address for READID */
                 fsl_qspi_set_base_addr(q, nor);
 
-                ret = spi_nor_scan(nor, id, SPI_NOR_QUAD);
+                ret = spi_nor_scan(nor, modalias, SPI_NOR_QUAD);
                 if (ret)
                         goto map_failed;
 
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index ae16aa2f6885..c51ee52386a7 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -28,6 +28,8 @@
 
 #define JEDEC_MFR(_jedec_id)    ((_jedec_id) >> 16)
 
+static const struct spi_device_id *spi_nor_match_id(const char *name);
+
 /*
  * Read the status register, returning its value in the location
  * Return the status register value.
@@ -473,7 +475,7 @@ struct flash_info {
  * more nor chips.  This current list focusses on newer chips, which
  * have been converging on command sets which including JEDEC ID.
  */
-const struct spi_device_id spi_nor_ids[] = {
+static const struct spi_device_id spi_nor_ids[] = {
         /* Atmel -- some are (confusingly) marketed as "DataFlash" */
         { "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
         { "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
@@ -637,7 +639,6 @@ const struct spi_device_id spi_nor_ids[] = {
         { "cat25128", CAT25_INFO(2048, 8, 64, 2, SPI_NOR_NO_ERASE | SPI_NOR_NO_FR) },
         { },
 };
-EXPORT_SYMBOL_GPL(spi_nor_ids);
 
 static const struct spi_device_id *spi_nor_read_id(struct spi_nor *nor)
 {
@@ -911,9 +912,9 @@ static int spi_nor_check(struct spi_nor *nor)
         return 0;
 }
 
-int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
-                        enum read_mode mode)
+int spi_nor_scan(struct spi_nor *nor, const char *name, enum read_mode mode)
 {
+        const struct spi_device_id      *id = NULL;
         struct flash_info               *info;
         struct device *dev = nor->dev;
         struct mtd_info *mtd = nor->mtd;
@@ -925,6 +926,10 @@ int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
         if (ret)
                 return ret;
 
+        id = spi_nor_match_id(name);
+        if (!id)
+                return -ENOENT;
+
         info = (void *)id->driver_data;
 
         if (info->jedec_id) {
@@ -1113,7 +1118,7 @@ int spi_nor_scan(struct spi_nor *nor, const struct spi_device_id *id,
 }
 EXPORT_SYMBOL_GPL(spi_nor_scan);
 
-const struct spi_device_id *spi_nor_match_id(char *name)
+static const struct spi_device_id *spi_nor_match_id(const char *name)
 {
         const struct spi_device_id *id = spi_nor_ids;
 
@@ -1124,7 +1129,6 @@ const struct spi_device_id *spi_nor_match_id(char *name)
         }
         return NULL;
 }
-EXPORT_SYMBOL_GPL(spi_nor_match_id);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Huang Shijie <shijie8@gmail.com>");
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 4706386b7d34..f9009be3f307 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -135,6 +135,7 @@ config MACVLAN
 config MACVTAP
         tristate "MAC-VLAN based tap driver"
         depends on MACVLAN
+        depends on INET
         help
           This adds a specialized tap character device driver that is based
           on the MAC-VLAN network interface, called macvtap. A macvtap device
@@ -200,6 +201,7 @@ config RIONET_RX_SIZE
 
 config TUN
         tristate "Universal TUN/TAP device driver support"
+        depends on INET
         select CRC32
         ---help---
           TUN/TAP provides packet reception and transmission for user space
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index c9ac06cfe6b7..a5115fb7cf33 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2471,7 +2471,8 @@ static void bond_loadbalance_arp_mon(struct work_struct *work)
                         bond_slave_state_change(bond);
                         if (BOND_MODE(bond) == BOND_MODE_XOR)
                                 bond_update_slave_arr(bond, NULL);
-                } else if (do_failover) {
+                }
+                if (do_failover) {
                         block_netpoll_tx();
                         bond_select_active_slave(bond);
                         unblock_netpoll_tx();
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 02492d241e4c..2cfe5012e4e5 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -110,7 +110,7 @@ static int can_calc_bittiming(struct net_device *dev, struct can_bittiming *bt,
         long rate;
         u64 v64;
 
-        /* Use CIA recommended sample points */
+        /* Use CiA recommended sample points */
         if (bt->sample_point) {
                 sampl_pt = bt->sample_point;
         } else {
@@ -382,7 +382,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx)
         BUG_ON(idx >= priv->echo_skb_max);
 
         if (priv->echo_skb[idx]) {
-                kfree_skb(priv->echo_skb[idx]);
+                dev_kfree_skb_any(priv->echo_skb[idx]);
                 priv->echo_skb[idx] = NULL;
         }
 }
diff --git a/drivers/net/can/m_can/Kconfig b/drivers/net/can/m_can/Kconfig
index fca5482c09ac..04f20dd39007 100644
--- a/drivers/net/can/m_can/Kconfig
+++ b/drivers/net/can/m_can/Kconfig
@@ -1,4 +1,5 @@
 config CAN_M_CAN
+        depends on HAS_IOMEM
         tristate "Bosch M_CAN devices"
         ---help---
           Say Y here if you want to support for Bosch M_CAN controller.
diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
index 10d571eaed85..d7bc462aafdc 100644
--- a/drivers/net/can/m_can/m_can.c
+++ b/drivers/net/can/m_can/m_can.c
@@ -105,14 +105,36 @@ enum m_can_mram_cfg {
         MRAM_CFG_NUM,
 };
 
+/* Fast Bit Timing & Prescaler Register (FBTP) */
+#define FBTR_FBRP_MASK          0x1f
+#define FBTR_FBRP_SHIFT         16
+#define FBTR_FTSEG1_SHIFT       8
+#define FBTR_FTSEG1_MASK        (0xf << FBTR_FTSEG1_SHIFT)
+#define FBTR_FTSEG2_SHIFT       4
+#define FBTR_FTSEG2_MASK        (0x7 << FBTR_FTSEG2_SHIFT)
+#define FBTR_FSJW_SHIFT         0
+#define FBTR_FSJW_MASK          0x3
+
 /* Test Register (TEST) */
 #define TEST_LBCK       BIT(4)
 
 /* CC Control Register(CCCR) */
-#define CCCR_TEST       BIT(7)
-#define CCCR_MON        BIT(5)
-#define CCCR_CCE        BIT(1)
-#define CCCR_INIT       BIT(0)
+#define CCCR_TEST               BIT(7)
+#define CCCR_CMR_MASK           0x3
+#define CCCR_CMR_SHIFT          10
+#define CCCR_CMR_CANFD          0x1
+#define CCCR_CMR_CANFD_BRS      0x2
+#define CCCR_CMR_CAN            0x3
+#define CCCR_CME_MASK           0x3
+#define CCCR_CME_SHIFT          8
+#define CCCR_CME_CAN            0
+#define CCCR_CME_CANFD          0x1
+#define CCCR_CME_CANFD_BRS      0x2
+#define CCCR_TEST               BIT(7)
+#define CCCR_MON                BIT(5)
+#define CCCR_CCE                BIT(1)
+#define CCCR_INIT               BIT(0)
+#define CCCR_CANFD              0x10
 
 /* Bit Timing & Prescaler Register (BTP) */
 #define BTR_BRP_MASK            0x3ff
@@ -204,6 +226,7 @@ enum m_can_mram_cfg {
 
 /* Rx Buffer / FIFO Element Size Configuration (RXESC) */
 #define M_CAN_RXESC_8BYTES      0x0
+#define M_CAN_RXESC_64BYTES     0x777
 
 /* Tx Buffer Configuration(TXBC) */
 #define TXBC_NDTB_OFF           16
@@ -211,6 +234,7 @@ enum m_can_mram_cfg {
 
 /* Tx Buffer Element Size Configuration(TXESC) */
 #define TXESC_TBDS_8BYTES       0x0
+#define TXESC_TBDS_64BYTES      0x7
 
 /* Tx Event FIFO Con.guration (TXEFC) */
 #define TXEFC_EFS_OFF           16
@@ -219,11 +243,11 @@ enum m_can_mram_cfg {
 /* Message RAM Configuration (in bytes) */
 #define SIDF_ELEMENT_SIZE       4
 #define XIDF_ELEMENT_SIZE       8
-#define RXF0_ELEMENT_SIZE       16
-#define RXF1_ELEMENT_SIZE       16
+#define RXF0_ELEMENT_SIZE       72
+#define RXF1_ELEMENT_SIZE       72
 #define RXB_ELEMENT_SIZE        16
 #define TXE_ELEMENT_SIZE        8
-#define TXB_ELEMENT_SIZE        16
+#define TXB_ELEMENT_SIZE        72
 
 /* Message RAM Elements */
 #define M_CAN_FIFO_ID           0x0
@@ -231,11 +255,17 @@ enum m_can_mram_cfg {
 #define M_CAN_FIFO_DATA(n)      (0x8 + ((n) << 2))
 
 /* Rx Buffer Element */
+/* R0 */
 #define RX_BUF_ESI              BIT(31)
 #define RX_BUF_XTD              BIT(30)
 #define RX_BUF_RTR              BIT(29)
+/* R1 */
+#define RX_BUF_ANMF             BIT(31)
+#define RX_BUF_EDL              BIT(21)
+#define RX_BUF_BRS              BIT(20)
 
 /* Tx Buffer Element */
+/* R0 */
 #define TX_BUF_XTD              BIT(30)
 #define TX_BUF_RTR              BIT(29)
 
@@ -296,6 +326,7 @@ static inline void m_can_config_endisable(const struct m_can_priv *priv,
         if (enable) {
                 /* enable m_can configuration */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT);
+                udelay(5);
                 /* CCCR.CCE can only be set/reset while CCCR.INIT = '1' */
                 m_can_write(priv, M_CAN_CCCR, cccr | CCCR_INIT | CCCR_CCE);
         } else {
@@ -326,41 +357,67 @@ static inline void m_can_disable_all_interrupts(const struct m_can_priv *priv)
         m_can_write(priv, M_CAN_ILE, 0x0);
 }
 
-static void m_can_read_fifo(const struct net_device *dev, struct can_frame *cf,
-                            u32 rxfs)
+static void m_can_read_fifo(struct net_device *dev, u32 rxfs)
 {
+        struct net_device_stats *stats = &dev->stats;
         struct m_can_priv *priv = netdev_priv(dev);
-        u32 id, fgi;
+        struct canfd_frame *cf;
+        struct sk_buff *skb;
+        u32 id, fgi, dlc;
+        int i;
 
         /* calculate the fifo get index for where to read data */
         fgi = (rxfs & RXFS_FGI_MASK) >> RXFS_FGI_OFF;
+        dlc = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
+        if (dlc & RX_BUF_EDL)
+                skb = alloc_canfd_skb(dev, &cf);
+        else
+                skb = alloc_can_skb(dev, (struct can_frame **)&cf);
+        if (!skb) {
+                stats->rx_dropped++;
+                return;
+        }
+
+        if (dlc & RX_BUF_EDL)
+                cf->len = can_dlc2len((dlc >> 16) & 0x0F);
+        else
+                cf->len = get_can_dlc((dlc >> 16) & 0x0F);
+
         id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_ID);
         if (id & RX_BUF_XTD)
                 cf->can_id = (id & CAN_EFF_MASK) | CAN_EFF_FLAG;
         else
                 cf->can_id = (id >> 18) & CAN_SFF_MASK;
 
-        if (id & RX_BUF_RTR) {
+        if (id & RX_BUF_ESI) {
+                cf->flags |= CANFD_ESI;
+                netdev_dbg(dev, "ESI Error\n");
+        }
+
+        if (!(dlc & RX_BUF_EDL) && (id & RX_BUF_RTR)) {
                 cf->can_id |= CAN_RTR_FLAG;
         } else {
-                id = m_can_fifo_read(priv, fgi, M_CAN_FIFO_DLC);
-                cf->can_dlc = get_can_dlc((id >> 16) & 0x0F);
-                *(u32 *)(cf->data + 0) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(0));
-                *(u32 *)(cf->data + 4) = m_can_fifo_read(priv, fgi,
-                                                         M_CAN_FIFO_DATA(1));
+                if (dlc & RX_BUF_BRS)
+                        cf->flags |= CANFD_BRS;
+
+                for (i = 0; i < cf->len; i += 4)
+                        *(u32 *)(cf->data + i) =
+                                m_can_fifo_read(priv, fgi,
+                                                M_CAN_FIFO_DATA(i / 4));
         }
 
         /* acknowledge rx fifo 0 */
         m_can_write(priv, M_CAN_RXF0A, fgi);
+
+        stats->rx_packets++;
+        stats->rx_bytes += cf->len;
+
+        netif_receive_skb(skb);
 }
 
 static int m_can_do_rx_poll(struct net_device *dev, int quota)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct net_device_stats *stats = &dev->stats;
-        struct sk_buff *skb;
-        struct can_frame *frame;
         u32 pkts = 0;
         u32 rxfs;
 
@@ -374,18 +431,7 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota)
                 if (rxfs & RXFS_RFL)
                         netdev_warn(dev, "Rx FIFO 0 Message Lost\n");
 
-                skb = alloc_can_skb(dev, &frame);
-                if (!skb) {
-                        stats->rx_dropped++;
-                        return pkts;
-                }
-
-                m_can_read_fifo(dev, frame, rxfs);
-
-                stats->rx_packets++;
-                stats->rx_bytes += frame->can_dlc;
-
-                netif_receive_skb(skb);
+                m_can_read_fifo(dev, rxfs);
 
                 quota--;
                 pkts++;
@@ -481,11 +527,23 @@ static int m_can_handle_lec_err(struct net_device *dev,
         return 1;
 }
 
+static int __m_can_get_berr_counter(const struct net_device *dev,
+                                    struct can_berr_counter *bec)
+{
+        struct m_can_priv *priv = netdev_priv(dev);
+        unsigned int ecr;
+
+        ecr = m_can_read(priv, M_CAN_ECR);
+        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
+        bec->txerr = ecr & ECR_TEC_MASK;
+
+        return 0;
+}
+
 static int m_can_get_berr_counter(const struct net_device *dev,
                                   struct can_berr_counter *bec)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        unsigned int ecr;
         int err;
 
         err = clk_prepare_enable(priv->hclk);
@@ -498,9 +556,7 @@ static int m_can_get_berr_counter(const struct net_device *dev,
                 return err;
         }
 
-        ecr = m_can_read(priv, M_CAN_ECR);
-        bec->rxerr = (ecr & ECR_REC_MASK) >> ECR_REC_SHIFT;
-        bec->txerr = ecr & ECR_TEC_MASK;
+        __m_can_get_berr_counter(dev, bec);
 
         clk_disable_unprepare(priv->cclk);
         clk_disable_unprepare(priv->hclk);
@@ -544,7 +600,7 @@ static int m_can_handle_state_change(struct net_device *dev,
         if (unlikely(!skb))
                 return 0;
 
-        m_can_get_berr_counter(dev, &bec);
+        __m_can_get_berr_counter(dev, &bec);
 
         switch (new_state) {
         case CAN_STATE_ERROR_ACTIVE:
@@ -596,14 +652,14 @@ static int m_can_handle_state_errors(struct net_device *dev, u32 psr)
 
         if ((psr & PSR_EP) &&
             (priv->can.state != CAN_STATE_ERROR_PASSIVE)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error passive state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_ERROR_PASSIVE);
         }
 
         if ((psr & PSR_BO) &&
             (priv->can.state != CAN_STATE_BUS_OFF)) {
-                netdev_dbg(dev, "entered error warning state\n");
+                netdev_dbg(dev, "entered error bus off state\n");
                 work_done += m_can_handle_state_change(dev,
                                                        CAN_STATE_BUS_OFF);
         }
@@ -615,7 +671,7 @@ static void m_can_handle_other_err(struct net_device *dev, u32 irqstatus)
 {
         if (irqstatus & IR_WDI)
                 netdev_err(dev, "Message RAM Watchdog event due to missing READY\n");
-        if (irqstatus & IR_BEU)
+        if (irqstatus & IR_ELO)
                 netdev_err(dev, "Error Logging Overflow\n");
         if (irqstatus & IR_BEU)
                 netdev_err(dev, "Bit Error Uncorrected\n");
@@ -733,10 +789,23 @@ static const struct can_bittiming_const m_can_bittiming_const = {
         .brp_inc = 1,
 };
 
+static const struct can_bittiming_const m_can_data_bittiming_const = {
+        .name = KBUILD_MODNAME,
+        .tseg1_min = 2,         /* Time segment 1 = prop_seg + phase_seg1 */
+        .tseg1_max = 16,
+        .tseg2_min = 1,         /* Time segment 2 = phase_seg2 */
+        .tseg2_max = 8,
+        .sjw_max = 4,
+        .brp_min = 1,
+        .brp_max = 32,
+        .brp_inc = 1,
+};
+
 static int m_can_set_bittiming(struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
         const struct can_bittiming *bt = &priv->can.bittiming;
+        const struct can_bittiming *dbt = &priv->can.data_bittiming;
         u16 brp, sjw, tseg1, tseg2;
         u32 reg_btp;
 
@@ -747,7 +816,17 @@ static int m_can_set_bittiming(struct net_device *dev)
         reg_btp = (brp << BTR_BRP_SHIFT) | (sjw << BTR_SJW_SHIFT) |
                         (tseg1 << BTR_TSEG1_SHIFT) | (tseg2 << BTR_TSEG2_SHIFT);
         m_can_write(priv, M_CAN_BTP, reg_btp);
-        netdev_dbg(dev, "setting BTP 0x%x\n", reg_btp);
+
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                brp = dbt->brp - 1;
+                sjw = dbt->sjw - 1;
+                tseg1 = dbt->prop_seg + dbt->phase_seg1 - 1;
+                tseg2 = dbt->phase_seg2 - 1;
+                reg_btp = (brp << FBTR_FBRP_SHIFT) | (sjw << FBTR_FSJW_SHIFT) |
+                                (tseg1 << FBTR_FTSEG1_SHIFT) |
+                                (tseg2 << FBTR_FTSEG2_SHIFT);
+                m_can_write(priv, M_CAN_FBTP, reg_btp);
+        }
 
         return 0;
 }
@@ -767,8 +846,8 @@ static void m_can_chip_config(struct net_device *dev)
 
         m_can_config_endisable(priv, true);
 
-        /* RX Buffer/FIFO Element Size 8 bytes data field */
-        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_8BYTES);
+        /* RX Buffer/FIFO Element Size 64 bytes data field */
+        m_can_write(priv, M_CAN_RXESC, M_CAN_RXESC_64BYTES);
 
         /* Accept Non-matching Frames Into FIFO 0 */
         m_can_write(priv, M_CAN_GFC, 0x0);
@@ -777,8 +856,8 @@ static void m_can_chip_config(struct net_device *dev)
         m_can_write(priv, M_CAN_TXBC, (1 << TXBC_NDTB_OFF) |
                     priv->mcfg[MRAM_TXB].off);
 
-        /* only support 8 bytes firstly */
-        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_8BYTES);
+        /* support 64 bytes payload */
+        m_can_write(priv, M_CAN_TXESC, TXESC_TBDS_64BYTES);
 
         m_can_write(priv, M_CAN_TXEFC, (1 << TXEFC_EFS_OFF) |
                     priv->mcfg[MRAM_TXE].off);
@@ -793,7 +872,8 @@ static void m_can_chip_config(struct net_device *dev)
                     RXFC_FWM_1 | priv->mcfg[MRAM_RXF1].off);
 
         cccr = m_can_read(priv, M_CAN_CCCR);
-        cccr &= ~(CCCR_TEST | CCCR_MON);
+        cccr &= ~(CCCR_TEST | CCCR_MON | (CCCR_CMR_MASK << CCCR_CMR_SHIFT) |
+                (CCCR_CME_MASK << CCCR_CME_SHIFT));
         test = m_can_read(priv, M_CAN_TEST);
         test &= ~TEST_LBCK;
 
@@ -805,6 +885,9 @@ static void m_can_chip_config(struct net_device *dev)
                 test |= TEST_LBCK;
         }
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD)
+                cccr |= CCCR_CME_CANFD_BRS << CCCR_CME_SHIFT;
+
         m_can_write(priv, M_CAN_CCCR, cccr);
         m_can_write(priv, M_CAN_TEST, test);
 
@@ -869,11 +952,13 @@ static struct net_device *alloc_m_can_dev(void)
 
         priv->dev = dev;
         priv->can.bittiming_const = &m_can_bittiming_const;
+        priv->can.data_bittiming_const = &m_can_data_bittiming_const;
         priv->can.do_set_mode = m_can_set_mode;
         priv->can.do_get_berr_counter = m_can_get_berr_counter;
         priv->can.ctrlmode_supported = CAN_CTRLMODE_LOOPBACK |
                                         CAN_CTRLMODE_LISTENONLY |
-                                        CAN_CTRLMODE_BERR_REPORTING;
+                                        CAN_CTRLMODE_BERR_REPORTING |
+                                        CAN_CTRLMODE_FD;
 
         return dev;
 }
@@ -956,8 +1041,9 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
         struct m_can_priv *priv = netdev_priv(dev);
-        struct can_frame *cf = (struct can_frame *)skb->data;
-        u32 id;
+        struct canfd_frame *cf = (struct canfd_frame *)skb->data;
+        u32 id, cccr;
+        int i;
 
         if (can_dropped_invalid_skb(dev, skb))
                 return NETDEV_TX_OK;
@@ -976,11 +1062,28 @@ static netdev_tx_t m_can_start_xmit(struct sk_buff *skb,
 
         /* message ram configuration */
         m_can_fifo_write(priv, 0, M_CAN_FIFO_ID, id);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, cf->can_dlc << 16);
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(0), *(u32 *)(cf->data + 0));
-        m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(1), *(u32 *)(cf->data + 4));
+        m_can_fifo_write(priv, 0, M_CAN_FIFO_DLC, can_len2dlc(cf->len) << 16);
+
+        for (i = 0; i < cf->len; i += 4)
+                m_can_fifo_write(priv, 0, M_CAN_FIFO_DATA(i / 4),
+                                 *(u32 *)(cf->data + i));
+
         can_put_echo_skb(skb, dev, 0);
 
+        if (priv->can.ctrlmode & CAN_CTRLMODE_FD) {
+                cccr = m_can_read(priv, M_CAN_CCCR);
+                cccr &= ~(CCCR_CMR_MASK << CCCR_CMR_SHIFT);
+                if (can_is_canfd_skb(skb)) {
+                        if (cf->flags & CANFD_BRS)
+                                cccr |= CCCR_CMR_CANFD_BRS << CCCR_CMR_SHIFT;
+                        else
+                                cccr |= CCCR_CMR_CANFD << CCCR_CMR_SHIFT;
+                } else {
+                        cccr |= CCCR_CMR_CAN << CCCR_CMR_SHIFT;
+                }
+                m_can_write(priv, M_CAN_CCCR, cccr);
+        }
+
         /* enable first TX buffer to start transfer  */
         m_can_write(priv, M_CAN_TXBTIE, 0x1);
         m_can_write(priv, M_CAN_TXBAR, 0x1);
@@ -992,6 +1095,7 @@ static const struct net_device_ops m_can_netdev_ops = {
         .ndo_open = m_can_open,
         .ndo_stop = m_can_close,
         .ndo_start_xmit = m_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static int register_m_can_dev(struct net_device *dev)
@@ -1009,7 +1113,7 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
         struct resource *res;
         void __iomem *addr;
         u32 out_val[MRAM_CFG_LEN];
-        int ret;
+        int i, start, end, ret;
 
         /* message ram could be shared */
         res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "message_ram");
@@ -1060,6 +1164,15 @@ static int m_can_of_parse_mram(struct platform_device *pdev,
                 priv->mcfg[MRAM_TXE].off, priv->mcfg[MRAM_TXE].num,
                 priv->mcfg[MRAM_TXB].off, priv->mcfg[MRAM_TXB].num);
 
+        /* initialize the entire Message RAM in use to avoid possible
+         * ECC/parity checksum errors when reading an uninitialized buffer
+         */
+        start = priv->mcfg[MRAM_SIDF].off;
+        end = priv->mcfg[MRAM_TXB].off +
+                priv->mcfg[MRAM_TXB].num * TXB_ELEMENT_SIZE;
+        for (i = start; i < end; i += 4)
+                writel(0x0, priv->mram_base + i);
+
         return 0;
 }
 
diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
index 1abe133d1594..9718248e55f1 100644
--- a/drivers/net/can/rcar_can.c
+++ b/drivers/net/can/rcar_can.c
@@ -628,6 +628,7 @@ static const struct net_device_ops rcar_can_netdev_ops = {
         .ndo_open = rcar_can_open,
         .ndo_stop = rcar_can_close,
         .ndo_start_xmit = rcar_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static void rcar_can_rx_pkt(struct rcar_can_priv *priv)
diff --git a/drivers/net/can/sja1000/kvaser_pci.c b/drivers/net/can/sja1000/kvaser_pci.c
index 8ff3424d5147..15c00faeec61 100644
--- a/drivers/net/can/sja1000/kvaser_pci.c
+++ b/drivers/net/can/sja1000/kvaser_pci.c
@@ -214,7 +214,7 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         struct net_device *dev;
         struct sja1000_priv *priv;
         struct kvaser_pci *board;
-        int err, init_step;
+        int err;
 
         dev = alloc_sja1000dev(sizeof(struct kvaser_pci));
         if (dev == NULL)
@@ -235,7 +235,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         if (channel == 0) {
                 board->xilinx_ver =
                         ioread8(board->res_addr + XILINX_VERINT) >> 4;
-                init_step = 2;
 
                 /* Assert PTADR# - we're in passive mode so the other bits are
                    not important */
@@ -264,8 +263,6 @@ static int kvaser_pci_add_chan(struct pci_dev *pdev, int channel,
         priv->irq_flags = IRQF_SHARED;
         dev->irq = pdev->irq;
 
-        init_step = 4;
-
         dev_info(&pdev->dev, "reg_base=%p conf_addr=%p irq=%d\n",
                  priv->reg_base, board->conf_addr, dev->irq);
 
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 00f2534dde73..29d3f0938eb8 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -434,10 +434,9 @@ static void ems_usb_read_bulk_callback(struct urb *urb)
         if (urb->actual_length > CPC_HEADER_SIZE) {
                 struct ems_cpc_msg *msg;
                 u8 *ibuf = urb->transfer_buffer;
-                u8 msg_count, again, start;
+                u8 msg_count, start;
 
                 msg_count = ibuf[0] & ~0x80;
-                again = ibuf[0] & 0x80;
 
                 start = CPC_HEADER_SIZE;
 
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index b7c9e8b11460..c063a54ab8dd 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -464,7 +464,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 {
         struct esd_tx_urb_context *context = urb->context;
         struct esd_usb2_net_priv *priv;
-        struct esd_usb2 *dev;
         struct net_device *netdev;
         size_t size = sizeof(struct esd_usb2_msg);
 
@@ -472,7 +471,6 @@ static void esd_usb2_write_bulk_callback(struct urb *urb)
 
         priv = context->priv;
         netdev = priv->netdev;
-        dev = priv->usb2;
 
         /* free up our allocated buffer */
         usb_free_coherent(urb->dev, size,
@@ -1143,6 +1141,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf)
                         }
                 }
                 unlink_all_urbs(dev);
+                kfree(dev);
         }
 }
 
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 04b0f84612f0..009acc8641fc 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -718,6 +718,7 @@ static const struct net_device_ops gs_usb_netdev_ops = {
         .ndo_open = gs_can_open,
         .ndo_stop = gs_can_close,
         .ndo_start_xmit = gs_can_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 static struct gs_can *gs_make_candev(unsigned int channel, struct usb_interface *intf)
diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c
index 5e8b5609c067..8a998e3884ce 100644
--- a/drivers/net/can/xilinx_can.c
+++ b/drivers/net/can/xilinx_can.c
@@ -300,7 +300,8 @@ static int xcan_set_bittiming(struct net_device *ndev)
 static int xcan_chip_start(struct net_device *ndev)
 {
         struct xcan_priv *priv = netdev_priv(ndev);
-        u32 err, reg_msr, reg_sr_mask;
+        u32 reg_msr, reg_sr_mask;
+        int err;
         unsigned long timeout;
 
         /* Check if it is in reset mode */
@@ -961,6 +962,7 @@ static const struct net_device_ops xcan_netdev_ops = {
         .ndo_open       = xcan_open,
         .ndo_stop       = xcan_close,
         .ndo_start_xmit = xcan_start_xmit,
+        .ndo_change_mtu = can_change_mtu,
 };
 
 /**
diff --git a/drivers/net/dsa/mv88e6171.c b/drivers/net/dsa/mv88e6171.c
index 1020a7af67cf..78d8e876f3aa 100644
--- a/drivers/net/dsa/mv88e6171.c
+++ b/drivers/net/dsa/mv88e6171.c
@@ -395,7 +395,7 @@ static int mv88e6171_get_sset_count(struct dsa_switch *ds)
 }
 
 struct dsa_switch_driver mv88e6171_switch_driver = {
-        .tag_protocol           = DSA_TAG_PROTO_DSA,
+        .tag_protocol           = DSA_TAG_PROTO_EDSA,
         .priv_size              = sizeof(struct mv88e6xxx_priv_state),
         .probe                  = mv88e6171_probe,
         .setup                  = mv88e6171_setup,
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index 29554992215a..2349ea970255 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -1465,7 +1465,7 @@ static int xgbe_set_features(struct net_device *netdev,
 {
         struct xgbe_prv_data *pdata = netdev_priv(netdev);
         struct xgbe_hw_if *hw_if = &pdata->hw_if;
-        unsigned int rxcsum, rxvlan, rxvlan_filter;
+        netdev_features_t rxcsum, rxvlan, rxvlan_filter;
 
         rxcsum = pdata->netdev_features & NETIF_F_RXCSUM;
         rxvlan = pdata->netdev_features & NETIF_F_HW_VLAN_CTAG_RX;
@@ -1598,7 +1598,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
         struct skb_shared_hwtstamps *hwtstamps;
         unsigned int incomplete, error, context_next, context;
         unsigned int len, put_len, max_len;
-        int received = 0;
+        unsigned int received = 0;
+        int packet_count = 0;
 
         DBGPR("-->xgbe_rx_poll: budget=%d\n", budget);
 
@@ -1608,7 +1609,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget)
 
         rdata = XGBE_GET_DESC_DATA(ring, ring->cur);
         packet = &ring->packet_data;
-        while (received < budget) {
+        while (packet_count < budget) {
                 DBGPR("  cur = %d\n", ring->cur);
 
                 /* First time in loop see if we need to restore state */
@@ -1662,7 +1663,7 @@ read_again:
                         if (packet->errors)
                                 DBGPR("Error in received packet\n");
                         dev_kfree_skb(skb);
-                        continue;
+                        goto next_packet;
                 }
 
                 if (!context) {
@@ -1677,7 +1678,7 @@ read_again:
                                         }
 
                                         dev_kfree_skb(skb);
-                                        continue;
+                                        goto next_packet;
                                 }
                                 memcpy(skb_tail_pointer(skb), rdata->skb->data,
                                        put_len);
@@ -1694,7 +1695,7 @@ read_again:
 
                 /* Stray Context Descriptor? */
                 if (!skb)
-                        continue;
+                        goto next_packet;
 
                 /* Be sure we don't exceed the configured MTU */
                 max_len = netdev->mtu + ETH_HLEN;
@@ -1705,7 +1706,7 @@ read_again:
                 if (skb->len > max_len) {
                         DBGPR("packet length exceeds configured MTU\n");
                         dev_kfree_skb(skb);
-                        continue;
+                        goto next_packet;
                 }
 
 #ifdef XGMAC_ENABLE_RX_PKT_DUMP
@@ -1739,6 +1740,9 @@ read_again:
 
                 netdev->last_rx = jiffies;
                 napi_gro_receive(&pdata->napi, skb);
+
+next_packet:
+                packet_count++;
         }
 
         /* Check if we need to save state before leaving */
@@ -1752,9 +1756,9 @@ read_again:
                 rdata->state.error = error;
         }
 
-        DBGPR("<--xgbe_rx_poll: received = %d\n", received);
+        DBGPR("<--xgbe_rx_poll: packet_count = %d\n", packet_count);
 
-        return received;
+        return packet_count;
 }
 
 static int xgbe_poll(struct napi_struct *napi, int budget)
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
index 63ea1941e973..7ba83ffb08ac 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.c
@@ -575,10 +575,24 @@ static void xgene_gmac_tx_disable(struct xgene_enet_pdata *pdata)
         xgene_enet_wr_mcx_mac(pdata, MAC_CONFIG_1_ADDR, data & ~TX_EN);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
+bool xgene_ring_mgr_init(struct xgene_enet_pdata *p)
+{
+        if (!ioread32(p->ring_csr_addr + CLKEN_ADDR))
+                return false;
+
+        if (ioread32(p->ring_csr_addr + SRST_ADDR))
+                return false;
+
+        return true;
+}
+
+static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
 {
         u32 val;
 
+        if (!xgene_ring_mgr_init(pdata))
+                return -ENODEV;
+
         clk_prepare_enable(pdata->clk);
         clk_disable_unprepare(pdata->clk);
         clk_prepare_enable(pdata->clk);
@@ -590,6 +604,8 @@ static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
         val |= SCAN_AUTO_INCR;
         MGMT_CLOCK_SEL_SET(&val, 1);
         xgene_enet_wr_mcx_mac(pdata, MII_MGMT_CONFIG_ADDR, val);
+
+        return 0;
 }
 
 static void xgene_gport_shutdown(struct xgene_enet_pdata *pdata)
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
index 38558584080e..ec45f3256f0e 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_hw.h
@@ -104,6 +104,9 @@ enum xgene_enet_rm {
 #define BLOCK_ETH_MAC_OFFSET            0x0000
 #define BLOCK_ETH_MAC_CSR_OFFSET        0x2800
 
+#define CLKEN_ADDR                      0xc208
+#define SRST_ADDR                       0xc200
+
 #define MAC_ADDR_REG_OFFSET             0x00
 #define MAC_COMMAND_REG_OFFSET          0x04
 #define MAC_WRITE_REG_OFFSET            0x08
@@ -318,6 +321,7 @@ void xgene_enet_parse_error(struct xgene_enet_desc_ring *ring,
 
 int xgene_enet_mdio_config(struct xgene_enet_pdata *pdata);
 void xgene_enet_mdio_remove(struct xgene_enet_pdata *pdata);
+bool xgene_ring_mgr_init(struct xgene_enet_pdata *p);
 
 extern struct xgene_mac_ops xgene_gmac_ops;
 extern struct xgene_port_ops xgene_gport_ops;
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
index 3c208cc6f6bb..123669696184 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.c
@@ -639,9 +639,9 @@ static int xgene_enet_create_desc_rings(struct net_device *ndev)
         struct device *dev = ndev_to_dev(ndev);
         struct xgene_enet_desc_ring *rx_ring, *tx_ring, *cp_ring;
         struct xgene_enet_desc_ring *buf_pool = NULL;
-        u8 cpu_bufnum = 0, eth_bufnum = 0;
-        u8 bp_bufnum = 0x20;
-        u16 ring_id, ring_num = 0;
+        u8 cpu_bufnum = 0, eth_bufnum = START_ETH_BUFNUM;
+        u8 bp_bufnum = START_BP_BUFNUM;
+        u16 ring_id, ring_num = START_RING_NUM;
         int ret;
 
         /* allocate rx descriptor ring */
@@ -852,7 +852,9 @@ static int xgene_enet_init_hw(struct xgene_enet_pdata *pdata)
         u16 dst_ring_num;
         int ret;
 
-        pdata->port_ops->reset(pdata);
+        ret = pdata->port_ops->reset(pdata);
+        if (ret)
+                return ret;
 
         ret = xgene_enet_create_desc_rings(ndev);
         if (ret) {
@@ -954,6 +956,7 @@ static int xgene_enet_probe(struct platform_device *pdev)
 
         return ret;
 err:
+        unregister_netdev(ndev);
         free_netdev(ndev);
         return ret;
 }
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
index 874e5a01161f..f9958fae6ffd 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_main.h
@@ -38,6 +38,9 @@
 #define SKB_BUFFER_SIZE         (XGENE_ENET_MAX_MTU - NET_IP_ALIGN)
 #define NUM_PKT_BUF     64
 #define NUM_BUFPOOL     32
+#define START_ETH_BUFNUM        2
+#define START_BP_BUFNUM         0x22
+#define START_RING_NUM          8
 
 #define PHY_POLL_LINK_ON        (10 * HZ)
 #define PHY_POLL_LINK_OFF       (PHY_POLL_LINK_ON / 5)
@@ -83,7 +86,7 @@ struct xgene_mac_ops {
 };
 
 struct xgene_port_ops {
-        void (*reset)(struct xgene_enet_pdata *pdata);
+        int (*reset)(struct xgene_enet_pdata *pdata);
         void (*cle_bypass)(struct xgene_enet_pdata *pdata,
                            u32 dst_ring_num, u16 bufpool_id);
         void (*shutdown)(struct xgene_enet_pdata *pdata);
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
index e6d24c210198..f5d4f68c288c 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_sgmac.c
@@ -124,20 +124,18 @@ static int xgene_enet_ecc_init(struct xgene_enet_pdata *p)
 {
         struct net_device *ndev = p->ndev;
         u32 data;
-        int i;
+        int i = 0;
 
         xgene_enet_wr_diag_csr(p, ENET_CFG_MEM_RAM_SHUTDOWN_ADDR, 0);
-        for (i = 0; i < 10 && data != ~0U ; i++) {
+        do {
                 usleep_range(100, 110);
                 data = xgene_enet_rd_diag_csr(p, ENET_BLOCK_MEM_RDY_ADDR);
-        }
-
-        if (data != ~0U) {
-                netdev_err(ndev, "Failed to release memory from shutdown\n");
-                return -ENODEV;
-        }
+                if (data == ~0U)
+                        return 0;
+        } while (++i < 10);
 
-        return 0;
+        netdev_err(ndev, "Failed to release memory from shutdown\n");
+        return -ENODEV;
 }
 
 static void xgene_enet_config_ring_if_assoc(struct xgene_enet_pdata *p)
@@ -313,14 +311,19 @@ static void xgene_sgmac_tx_disable(struct xgene_enet_pdata *p)
         xgene_sgmac_rxtx(p, TX_EN, false);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *p)
+static int xgene_enet_reset(struct xgene_enet_pdata *p)
 {
+        if (!xgene_ring_mgr_init(p))
+                return -ENODEV;
+
         clk_prepare_enable(p->clk);
         clk_disable_unprepare(p->clk);
         clk_prepare_enable(p->clk);
 
         xgene_enet_ecc_init(p);
         xgene_enet_config_ring_if_assoc(p);
+
+        return 0;
 }
 
 static void xgene_enet_cle_bypass(struct xgene_enet_pdata *p,
diff --git a/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c b/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
index 67d07206b3c7..a18a9d1f1143 100644
--- a/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
+++ b/drivers/net/ethernet/apm/xgene/xgene_enet_xgmac.c
@@ -252,14 +252,19 @@ static void xgene_xgmac_tx_disable(struct xgene_enet_pdata *pdata)
         xgene_enet_wr_mac(pdata, AXGMAC_CONFIG_1, data & ~HSTTFEN);
 }
 
-static void xgene_enet_reset(struct xgene_enet_pdata *pdata)
+static int xgene_enet_reset(struct xgene_enet_pdata *pdata)
 {
+        if (!xgene_ring_mgr_init(pdata))
+                return -ENODEV;
+
         clk_prepare_enable(pdata->clk);
         clk_disable_unprepare(pdata->clk);
         clk_prepare_enable(pdata->clk);
 
         xgene_enet_ecc_init(pdata);
         xgene_enet_config_ring_if_assoc(pdata);
+
+        return 0;
 }
 
 static void xgene_enet_xgcle_bypass(struct xgene_enet_pdata *pdata,
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 9ae36979bdee..531bb7c57531 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1110,7 +1110,8 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv,
         /* We just need one DMA descriptor which is DMA-able, since writing to
          * the port will allocate a new descriptor in its internal linked-list
          */
-        p = dma_zalloc_coherent(kdev, 1, &ring->desc_dma, GFP_KERNEL);
+        p = dma_zalloc_coherent(kdev, sizeof(struct dma_desc), &ring->desc_dma,
+                                GFP_KERNEL);
         if (!p) {
                 netif_err(priv, hw, priv->netdev, "DMA alloc failed\n");
                 return -ENOMEM;
@@ -1174,6 +1175,13 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         if (!(reg & TDMA_DISABLED))
                 netdev_warn(priv->netdev, "TDMA not stopped!\n");
 
+        /* ring->cbs is the last part in bcm_sysport_init_tx_ring which could
+         * fail, so by checking this pointer we know whether the TX ring was
+         * fully initialized or not.
+         */
+        if (!ring->cbs)
+                return;
+
         napi_disable(&ring->napi);
         netif_napi_del(&ring->napi);
 
@@ -1183,7 +1191,8 @@ static void bcm_sysport_fini_tx_ring(struct bcm_sysport_priv *priv,
         ring->cbs = NULL;
 
         if (ring->desc_dma) {
-                dma_free_coherent(kdev, 1, ring->desc_cpu, ring->desc_dma);
+                dma_free_coherent(kdev, sizeof(struct dma_desc),
+                                  ring->desc_cpu, ring->desc_dma);
                 ring->desc_dma = 0;
         }
         ring->size = 0;
@@ -1397,6 +1406,9 @@ static void bcm_sysport_netif_start(struct net_device *dev)
         /* Enable NAPI */
         napi_enable(&priv->napi);
 
+        /* Enable RX interrupt and TX ring full interrupt */
+        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
+
         phy_start(priv->phydev);
 
         /* Enable TX interrupts for the 32 TXQs */
@@ -1499,9 +1511,6 @@ static int bcm_sysport_open(struct net_device *dev)
         if (ret)
                 goto out_free_rx_ring;
 
-        /* Enable RX interrupt and TX ring full interrupt */
-        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
-
         /* Turn on TDMA */
         ret = tdma_enable_set(priv, 1);
         if (ret)
@@ -1858,6 +1867,8 @@ static int bcm_sysport_resume(struct device *d)
         if (!netif_running(dev))
                 return 0;
 
+        umac_reset(priv);
+
         /* We may have been suspended and never received a WOL event that
          * would turn off MPD detection, take care of that now
          */
@@ -1885,9 +1896,6 @@ static int bcm_sysport_resume(struct device *d)
 
         netif_device_attach(dev);
 
-        /* Enable RX interrupt and TX ring full interrupt */
-        intrl2_0_mask_clear(priv, INTRL2_0_RDMA_MBDONE | INTRL2_0_TX_RING_FULL);
-
         /* RX pipe enable */
         topctrl_writel(priv, 0, RX_FLUSH_CNTL);
 
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index 23f23c97c2ad..f05fab65d78a 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -382,10 +382,8 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
                 if (l5_cid >= MAX_CM_SK_TBL_SZ)
                         break;
 
-                rcu_read_lock();
                 if (!rcu_access_pointer(cp->ulp_ops[CNIC_ULP_L4])) {
                         rc = -ENODEV;
-                        rcu_read_unlock();
                         break;
                 }
                 csk = &cp->csk_tbl[l5_cid];
@@ -414,7 +412,6 @@ static int cnic_iscsi_nl_msg_recv(struct cnic_dev *dev, u32 msg_type,
                         }
                 }
                 csk_put(csk);
-                rcu_read_unlock();
                 rc = 0;
         }
         }
@@ -615,7 +612,7 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
                 cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
 
         mutex_lock(&cnic_lock);
-        if (rcu_dereference(cp->ulp_ops[ulp_type])) {
+        if (rcu_access_pointer(cp->ulp_ops[ulp_type])) {
                 RCU_INIT_POINTER(cp->ulp_ops[ulp_type], NULL);
                 cnic_put(dev);
         } else {
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index fdc9ec09e453..da1a2500c91c 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -2140,6 +2140,12 @@ static int bcmgenet_open(struct net_device *dev)
                 goto err_irq0;
         }
 
+        /* Re-configure the port multiplexer towards the PHY device */
+        bcmgenet_mii_config(priv->dev, false);
+
+        phy_connect_direct(dev, priv->phydev, bcmgenet_mii_setup,
+                           priv->phy_interface);
+
         bcmgenet_netif_start(dev);
 
         return 0;
@@ -2184,6 +2190,9 @@ static int bcmgenet_close(struct net_device *dev)
 
         bcmgenet_netif_stop(dev);
 
+        /* Really kill the PHY state machine and disconnect from it */
+        phy_disconnect(priv->phydev);
+
         /* Disable MAC receive */
         umac_enable_set(priv, CMD_RX_EN, false);
 
@@ -2685,7 +2694,7 @@ static int bcmgenet_resume(struct device *d)
 
         phy_init_hw(priv->phydev);
         /* Speed settings must be restored */
-        bcmgenet_mii_config(priv->dev);
+        bcmgenet_mii_config(priv->dev, false);
 
         /* disable ethernet MAC while updating its registers */
         umac_enable_set(priv, CMD_TX_EN | CMD_RX_EN, false);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
index dbf524ea3b19..31b2da5f9b82 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -617,9 +617,10 @@ GENET_IO_MACRO(rbuf, GENET_RBUF_OFF);
 
 /* MDIO routines */
 int bcmgenet_mii_init(struct net_device *dev);
-int bcmgenet_mii_config(struct net_device *dev);
+int bcmgenet_mii_config(struct net_device *dev, bool init);
 void bcmgenet_mii_exit(struct net_device *dev);
 void bcmgenet_mii_reset(struct net_device *dev);
+void bcmgenet_mii_setup(struct net_device *dev);
 
 /* Wake-on-LAN routines */
 void bcmgenet_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol);
diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
index 9ff799a9f801..933cd7e7cd33 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -77,7 +77,7 @@ static int bcmgenet_mii_write(struct mii_bus *bus, int phy_id,
 /* setup netdev link state when PHY link status change and
  * update UMAC and RGMII block when link up
  */
-static void bcmgenet_mii_setup(struct net_device *dev)
+void bcmgenet_mii_setup(struct net_device *dev)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -211,7 +211,7 @@ static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv)
         bcmgenet_sys_writel(priv, reg, SYS_PORT_CTRL);
 }
 
-int bcmgenet_mii_config(struct net_device *dev)
+int bcmgenet_mii_config(struct net_device *dev, bool init)
 {
         struct bcmgenet_priv *priv = netdev_priv(dev);
         struct phy_device *phydev = priv->phydev;
@@ -298,7 +298,8 @@ int bcmgenet_mii_config(struct net_device *dev)
                 return -EINVAL;
         }
 
-        dev_info(kdev, "configuring instance for %s\n", phy_name);
+        if (init)
+                dev_info(kdev, "configuring instance for %s\n", phy_name);
 
         return 0;
 }
@@ -350,7 +351,7 @@ static int bcmgenet_mii_probe(struct net_device *dev)
          * PHY speed which is needed for bcmgenet_mii_config() to configure
          * things appropriately.
          */
-        ret = bcmgenet_mii_config(dev);
+        ret = bcmgenet_mii_config(dev, true);
         if (ret) {
                 phy_disconnect(priv->phydev);
                 return ret;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
index 8edf0f5bd679..4fe33606f372 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c
@@ -60,6 +60,43 @@ void cxgb4_dcb_version_init(struct net_device *dev)
         dcb->dcb_version = FW_PORT_DCB_VER_AUTO;
 }
 
+static void cxgb4_dcb_cleanup_apps(struct net_device *dev)
+{
+        struct port_info *pi = netdev2pinfo(dev);
+        struct adapter *adap = pi->adapter;
+        struct port_dcb_info *dcb = &pi->dcb;
+        struct dcb_app app;
+        int i, err;
+
+        /* zero priority implies remove */
+        app.priority = 0;
+
+        for (i = 0; i < CXGB4_MAX_DCBX_APP_SUPPORTED; i++) {
+                /* Check if app list is exhausted */
+                if (!dcb->app_priority[i].protocolid)
+                        break;
+
+                app.protocol = dcb->app_priority[i].protocolid;
+
+                if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE) {
+                        app.priority = dcb->app_priority[i].user_prio_map;
+                        app.selector = dcb->app_priority[i].sel_field + 1;
+                        err = dcb_ieee_delapp(dev, &app);
+                } else {
+                        app.selector = !!(dcb->app_priority[i].sel_field);
+                        err = dcb_setapp(dev, &app);
+                }
+
+                if (err) {
+                        dev_err(adap->pdev_dev,
+                                "Failed DCB Clear %s Application Priority: sel=%d, prot=%d, , err=%d\n",
+                                dcb_ver_array[dcb->dcb_version], app.selector,
+                                app.protocol, -err);
+                        break;
+                }
+        }
+}
+
 /* Finite State machine for Data Center Bridging.
  */
 void cxgb4_dcb_state_fsm(struct net_device *dev,
@@ -80,14 +117,17 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                         /* we're going to use Host DCB */
                         dcb->state = CXGB4_DCB_STATE_HOST;
                         dcb->supported = CXGB4_DCBX_HOST_SUPPORT;
-                        dcb->enabled = 1;
                         break;
                 }
 
                 case CXGB4_DCB_INPUT_FW_ENABLED: {
                         /* we're going to use Firmware DCB */
                         dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE;
-                        dcb->supported = CXGB4_DCBX_FW_SUPPORT;
+                        dcb->supported = DCB_CAP_DCBX_LLD_MANAGED;
+                        if (dcb->dcb_version == FW_PORT_DCB_VER_IEEE)
+                                dcb->supported |= DCB_CAP_DCBX_VER_IEEE;
+                        else
+                                dcb->supported |= DCB_CAP_DCBX_VER_CEE;
                         break;
                 }
 
@@ -145,6 +185,7 @@ void cxgb4_dcb_state_fsm(struct net_device *dev,
                          * state.  We need to reset back to a ground state
                          * of incomplete.
                          */
+                        cxgb4_dcb_cleanup_apps(dev);
                         cxgb4_dcb_state_init(dev);
                         dcb->state = CXGB4_DCB_STATE_FW_INCOMPLETE;
                         dcb->supported = CXGB4_DCBX_FW_SUPPORT;
@@ -349,6 +390,12 @@ static u8 cxgb4_setstate(struct net_device *dev, u8 enabled)
 {
         struct port_info *pi = netdev2pinfo(dev);
 
+        /* If DCBx is host-managed, dcb is enabled by outside lldp agents */
+        if (pi->dcb.state == CXGB4_DCB_STATE_HOST) {
+                pi->dcb.enabled = enabled;
+                return 0;
+        }
+
         /* Firmware doesn't provide any mechanism to control the DCB state.
          */
         if (enabled != (pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED))
@@ -394,14 +441,17 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc,
         *up_tc_map = (1 << tc);
 
         /* prio_type is link strict */
-        *prio_type = 0x2;
+        if (*pgid != 0xF)
+                *prio_type = 0x2;
 }
 
 static void cxgb4_getpgtccfg_tx(struct net_device *dev, int tc,
                                 u8 *prio_type, u8 *pgid, u8 *bw_per,
                                 u8 *up_tc_map)
 {
-        return cxgb4_getpgtccfg(dev, tc, prio_type, pgid, bw_per, up_tc_map, 1);
+        /* tc 0 is written at MSB position */
+        return cxgb4_getpgtccfg(dev, (7 - tc), prio_type, pgid, bw_per,
+                                up_tc_map, 1);
 }
 
 
@@ -409,7 +459,9 @@ static void cxgb4_getpgtccfg_rx(struct net_device *dev, int tc,
                                 u8 *prio_type, u8 *pgid, u8 *bw_per,
                                 u8 *up_tc_map)
 {
-        return cxgb4_getpgtccfg(dev, tc, prio_type, pgid, bw_per, up_tc_map, 0);
+        /* tc 0 is written at MSB position */
+        return cxgb4_getpgtccfg(dev, (7 - tc), prio_type, pgid, bw_per,
+                                up_tc_map, 0);
 }
 
 static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
@@ -419,6 +471,7 @@ static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
         struct fw_port_cmd pcmd;
         struct port_info *pi = netdev2pinfo(dev);
         struct adapter *adap = pi->adapter;
+        int fw_tc = 7 - tc;
         u32 _pgid;
         int err;
 
@@ -437,8 +490,8 @@ static void cxgb4_setpgtccfg_tx(struct net_device *dev, int tc,
         }
 
         _pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
-        _pgid &= ~(0xF << (tc * 4));
-        _pgid |= pgid << (tc * 4);
+        _pgid &= ~(0xF << (fw_tc * 4));
+        _pgid |= pgid << (fw_tc * 4);
         pcmd.u.dcb.pgid.pgid = cpu_to_be32(_pgid);
 
         INIT_PORT_DCB_WRITE_CMD(pcmd, pi->port_id);
@@ -551,7 +604,7 @@ static void cxgb4_getpfccfg(struct net_device *dev, int priority, u8 *pfccfg)
             priority >= CXGB4_MAX_PRIORITY)
                 *pfccfg = 0;
         else
-                *pfccfg = (pi->dcb.pfcen >> priority) & 1;
+                *pfccfg = (pi->dcb.pfcen >> (7 - priority)) & 1;
 }
 
 /* Enable/disable Priority Pause Frames for the specified Traffic Class
@@ -576,9 +629,9 @@ static void cxgb4_setpfccfg(struct net_device *dev, int priority, u8 pfccfg)
         pcmd.u.dcb.pfc.pfcen = pi->dcb.pfcen;
 
         if (pfccfg)
-                pcmd.u.dcb.pfc.pfcen |= (1 << priority);
+                pcmd.u.dcb.pfc.pfcen |= (1 << (7 - priority));
         else
-                pcmd.u.dcb.pfc.pfcen &= (~(1 << priority));
+                pcmd.u.dcb.pfc.pfcen &= (~(1 << (7 - priority)));
 
         err = t4_wr_mbox(adap, adap->mbox, &pcmd, sizeof(pcmd), &pcmd);
         if (err != FW_PORT_DCB_CFG_SUCCESS) {
@@ -833,11 +886,16 @@ static int cxgb4_setapp(struct net_device *dev, u8 app_idtype, u16 app_id,
 
 /* Return whether IEEE Data Center Bridging has been negotiated.
  */
-static inline int cxgb4_ieee_negotiation_complete(struct net_device *dev)
+static inline int
+cxgb4_ieee_negotiation_complete(struct net_device *dev,
+                                enum cxgb4_dcb_fw_msgs dcb_subtype)
 {
         struct port_info *pi = netdev2pinfo(dev);
         struct port_dcb_info *dcb = &pi->dcb;
 
+        if (dcb_subtype && !(dcb->msgs & dcb_subtype))
+                return 0;
+
         return (dcb->state == CXGB4_DCB_STATE_FW_ALLSYNCED &&
                 (dcb->supported & DCB_CAP_DCBX_VER_IEEE));
 }
@@ -850,7 +908,7 @@ static int cxgb4_ieee_getapp(struct net_device *dev, struct dcb_app *app)
 {
         int prio;
 
-        if (!cxgb4_ieee_negotiation_complete(dev))
+        if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID))
                 return -EINVAL;
         if (!(app->selector && app->protocol))
                 return -EINVAL;
@@ -872,7 +930,7 @@ static int cxgb4_ieee_setapp(struct net_device *dev, struct dcb_app *app)
 {
         int ret;
 
-        if (!cxgb4_ieee_negotiation_complete(dev))
+        if (!cxgb4_ieee_negotiation_complete(dev, CXGB4_DCB_FW_APP_ID))
                 return -EINVAL;
         if (!(app->selector && app->protocol))
                 return -EINVAL;
@@ -1024,7 +1082,7 @@ static int cxgb4_cee_peer_getpg(struct net_device *dev, struct cee_pg *pg)
         pgid = be32_to_cpu(pcmd.u.dcb.pgid.pgid);
 
         for (i = 0; i < CXGB4_MAX_PRIORITY; i++)
-                pg->prio_pg[i] = (pgid >> (i * 4)) & 0xF;
+                pg->prio_pg[7 - i] = (pgid >> (i * 4)) & 0xF;
 
         INIT_PORT_DCB_READ_PEER_CMD(pcmd, pi->port_id);
         pcmd.u.dcb.pgrate.type = FW_PORT_DCB_TYPE_PGRATE;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 3f60070f2519..8520d5529df8 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -694,7 +694,11 @@ int cxgb4_dcb_enabled(const struct net_device *dev)
 #ifdef CONFIG_CHELSIO_T4_DCB
         struct port_info *pi = netdev_priv(dev);
 
-        return pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED;
+        if (!pi->dcb.enabled)
+                return 0;
+
+        return ((pi->dcb.state == CXGB4_DCB_STATE_FW_ALLSYNCED) ||
+                (pi->dcb.state == CXGB4_DCB_STATE_HOST));
 #else
         return 0;
 #endif
@@ -6610,6 +6614,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         spin_lock_init(&adapter->stats_lock);
         spin_lock_init(&adapter->tid_release_lock);
+        spin_lock_init(&adapter->win0_lock);
 
         INIT_WORK(&adapter->tid_release_task, process_tid_release_list);
         INIT_WORK(&adapter->db_full_task, process_db_full);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index 5e1b314e11af..39f2b13e66c7 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2914,7 +2914,8 @@ static int t4_sge_init_hard(struct adapter *adap)
 int t4_sge_init(struct adapter *adap)
 {
         struct sge *s = &adap->sge;
-        u32 sge_control, sge_conm_ctrl;
+        u32 sge_control, sge_control2, sge_conm_ctrl;
+        unsigned int ingpadboundary, ingpackboundary;
         int ret, egress_threshold;
 
         /*
@@ -2924,8 +2925,31 @@ int t4_sge_init(struct adapter *adap)
         sge_control = t4_read_reg(adap, SGE_CONTROL);
         s->pktshift = PKTSHIFT_GET(sge_control);
         s->stat_len = (sge_control & EGRSTATUSPAGESIZE_MASK) ? 128 : 64;
-        s->fl_align = 1 << (INGPADBOUNDARY_GET(sge_control) +
-                            X_INGPADBOUNDARY_SHIFT);
+
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately.  The actual Ingress Packet Data alignment boundary
+         * within Packed Buffer Mode is the maximum of these two
+         * specifications.
+         */
+        ingpadboundary = 1 << (INGPADBOUNDARY_GET(sge_control) +
+                               X_INGPADBOUNDARY_SHIFT);
+        if (is_t4(adap->params.chip)) {
+                s->fl_align = ingpadboundary;
+        } else {
+                /* T5 has a different interpretation of one of the PCIe Packing
+                 * Boundary values.
+                 */
+                sge_control2 = t4_read_reg(adap, SGE_CONTROL2_A);
+                ingpackboundary = INGPACKBOUNDARY_G(sge_control2);
+                if (ingpackboundary == INGPACKBOUNDARY_16B_X)
+                        ingpackboundary = 16;
+                else
+                        ingpackboundary = 1 << (ingpackboundary +
+                                                INGPACKBOUNDARY_SHIFT_X);
+
+                s->fl_align = max(ingpadboundary, ingpackboundary);
+        }
 
         if (adap->flags & USING_SOFT_PARAMS)
                 ret = t4_sge_init_soft(adap);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index a9d9d74e4f09..163a2a14948c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3129,12 +3129,51 @@ int t4_fixup_host_params(struct adapter *adap, unsigned int page_size,
                      HOSTPAGESIZEPF6(sge_hps) |
                      HOSTPAGESIZEPF7(sge_hps));
 
-        t4_set_reg_field(adap, SGE_CONTROL,
-                         INGPADBOUNDARY_MASK |
-                         EGRSTATUSPAGESIZE_MASK,
-                         INGPADBOUNDARY(fl_align_log - 5) |
-                         EGRSTATUSPAGESIZE(stat_len != 64));
-
+        if (is_t4(adap->params.chip)) {
+                t4_set_reg_field(adap, SGE_CONTROL,
+                                 INGPADBOUNDARY_MASK |
+                                 EGRSTATUSPAGESIZE_MASK,
+                                 INGPADBOUNDARY(fl_align_log - 5) |
+                                 EGRSTATUSPAGESIZE(stat_len != 64));
+        } else {
+                /* T5 introduced the separation of the Free List Padding and
+                 * Packing Boundaries.  Thus, we can select a smaller Padding
+                 * Boundary to avoid uselessly chewing up PCIe Link and Memory
+                 * Bandwidth, and use a Packing Boundary which is large enough
+                 * to avoid false sharing between CPUs, etc.
+                 *
+                 * For the PCI Link, the smaller the Padding Boundary the
+                 * better.  For the Memory Controller, a smaller Padding
+                 * Boundary is better until we cross under the Memory Line
+                 * Size (the minimum unit of transfer to/from Memory).  If we
+                 * have a Padding Boundary which is smaller than the Memory
+                 * Line Size, that'll involve a Read-Modify-Write cycle on the
+                 * Memory Controller which is never good.  For T5 the smallest
+                 * Padding Boundary which we can select is 32 bytes which is
+                 * larger than any known Memory Controller Line Size so we'll
+                 * use that.
+                 *
+                 * T5 has a different interpretation of the "0" value for the
+                 * Packing Boundary.  This corresponds to 16 bytes instead of
+                 * the expected 32 bytes.  We never have a Packing Boundary
+                 * less than 32 bytes so we can't use that special value but
+                 * on the other hand, if we wanted 32 bytes, the best we can
+                 * really do is 64 bytes.
+                */
+                if (fl_align <= 32) {
+                        fl_align = 64;
+                        fl_align_log = 6;
+                }
+                t4_set_reg_field(adap, SGE_CONTROL,
+                                 INGPADBOUNDARY_MASK |
+                                 EGRSTATUSPAGESIZE_MASK,
+                                 INGPADBOUNDARY(INGPCIEBOUNDARY_32B_X) |
+                                 EGRSTATUSPAGESIZE(stat_len != 64));
+                t4_set_reg_field(adap, SGE_CONTROL2_A,
+                                 INGPACKBOUNDARY_V(INGPACKBOUNDARY_M),
+                                 INGPACKBOUNDARY_V(fl_align_log -
+                                                 INGPACKBOUNDARY_SHIFT_X));
+        }
         /*
          * Adjust various SGE Free List Host Buffer Sizes.
          *
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index a1024db5dc13..8d2de1006b08 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -95,6 +95,7 @@
 #define X_INGPADBOUNDARY_SHIFT 5
 
 #define SGE_CONTROL 0x1008
+#define SGE_CONTROL2_A          0x1124
 #define  DCASYSTYPE             0x00080000U
 #define  RXPKTCPLMODE_MASK      0x00040000U
 #define  RXPKTCPLMODE_SHIFT     18
@@ -106,6 +107,7 @@
 #define  PKTSHIFT_SHIFT         10
 #define  PKTSHIFT(x)            ((x) << PKTSHIFT_SHIFT)
 #define  PKTSHIFT_GET(x)        (((x) & PKTSHIFT_MASK) >> PKTSHIFT_SHIFT)
+#define  INGPCIEBOUNDARY_32B_X  0
 #define  INGPCIEBOUNDARY_MASK   0x00000380U
 #define  INGPCIEBOUNDARY_SHIFT  7
 #define  INGPCIEBOUNDARY(x)     ((x) << INGPCIEBOUNDARY_SHIFT)
@@ -114,6 +116,14 @@
 #define  INGPADBOUNDARY(x)      ((x) << INGPADBOUNDARY_SHIFT)
 #define  INGPADBOUNDARY_GET(x)  (((x) & INGPADBOUNDARY_MASK) \
                                  >> INGPADBOUNDARY_SHIFT)
+#define  INGPACKBOUNDARY_16B_X  0
+#define  INGPACKBOUNDARY_SHIFT_X 5
+
+#define  INGPACKBOUNDARY_S      16
+#define  INGPACKBOUNDARY_M      0x7U
+#define  INGPACKBOUNDARY_V(x)   ((x) << INGPACKBOUNDARY_S)
+#define  INGPACKBOUNDARY_G(x)   (((x) >> INGPACKBOUNDARY_S) \
+                                 & INGPACKBOUNDARY_M)
 #define  EGRPCIEBOUNDARY_MASK   0x0000000eU
 #define  EGRPCIEBOUNDARY_SHIFT  1
 #define  EGRPCIEBOUNDARY(x)     ((x) << EGRPCIEBOUNDARY_SHIFT)
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
index 68eaa9c88c7d..3d06e77d7121 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/adapter.h
@@ -299,6 +299,14 @@ struct sge {
         u16 timer_val[SGE_NTIMERS];     /* interrupt holdoff timer array */
         u8 counter_val[SGE_NCOUNTERS];  /* interrupt RX threshold array */
 
+        /* Decoded Adapter Parameters.
+         */
+        u32 fl_pg_order;                /* large page allocation size */
+        u32 stat_len;                   /* length of status page at ring end */
+        u32 pktshift;                   /* padding between CPL & packet data */
+        u32 fl_align;                   /* response queue message alignment */
+        u32 fl_starve_thres;            /* Free List starvation threshold */
+
         /*
          * Reverse maps from Absolute Queue IDs to associated queue pointers.
          * The absolute Queue IDs are in a compact range which start at a
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
index bfa398d91826..0b42bddaf284 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/cxgb4vf_main.c
@@ -2929,14 +2929,14 @@ static const struct pci_device_id cxgb4vf_pci_tbl[] = {
         CH_DEVICE(0x480d),      /* T480-cr */
         CH_DEVICE(0x480e),      /* T440-lp-cr */
         CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
-        CH_DEVICE(0x4880),
+        CH_DEVICE(0x4881),
+        CH_DEVICE(0x4882),
+        CH_DEVICE(0x4883),
+        CH_DEVICE(0x4884),
+        CH_DEVICE(0x4885),
+        CH_DEVICE(0x4886),
+        CH_DEVICE(0x4887),
+        CH_DEVICE(0x4888),
         CH_DEVICE(0x5801),      /* T520-cr */
         CH_DEVICE(0x5802),      /* T522-cr */
         CH_DEVICE(0x5803),      /* T540-cr */
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
index 85036e6b42c4..fdd078d7d82c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c
@@ -51,14 +51,6 @@
 #include "../cxgb4/t4_msg.h"
 
 /*
- * Decoded Adapter Parameters.
- */
-static u32 FL_PG_ORDER;         /* large page allocation size */
-static u32 STAT_LEN;            /* length of status page at ring end */
-static u32 PKTSHIFT;            /* padding between CPL and packet data */
-static u32 FL_ALIGN;            /* response queue message alignment */
-
-/*
  * Constants ...
  */
 enum {
@@ -102,12 +94,6 @@ enum {
         MAX_TIMER_TX_RECLAIM = 100,
 
         /*
-         * An FL with <= FL_STARVE_THRES buffers is starving and a periodic
-         * timer will attempt to refill it.
-         */
-        FL_STARVE_THRES = 4,
-
-        /*
          * Suspend an Ethernet TX queue with fewer available descriptors than
          * this.  We always want to have room for a maximum sized packet:
          * inline immediate data + MAX_SKB_FRAGS. This is the same as
@@ -264,15 +250,19 @@ static inline unsigned int fl_cap(const struct sge_fl *fl)
 
 /**
  *      fl_starving - return whether a Free List is starving.
+ *      @adapter: pointer to the adapter
  *      @fl: the Free List
  *
  *      Tests specified Free List to see whether the number of buffers
  *      available to the hardware has falled below our "starvation"
  *      threshold.
  */
-static inline bool fl_starving(const struct sge_fl *fl)
+static inline bool fl_starving(const struct adapter *adapter,
+                               const struct sge_fl *fl)
 {
-        return fl->avail - fl->pend_cred <= FL_STARVE_THRES;
+        const struct sge *s = &adapter->sge;
+
+        return fl->avail - fl->pend_cred <= s->fl_starve_thres;
 }
 
 /**
@@ -457,13 +447,16 @@ static inline void reclaim_completed_tx(struct adapter *adapter,
 
 /**
  *      get_buf_size - return the size of an RX Free List buffer.
+ *      @adapter: pointer to the associated adapter
  *      @sdesc: pointer to the software buffer descriptor
  */
-static inline int get_buf_size(const struct rx_sw_desc *sdesc)
+static inline int get_buf_size(const struct adapter *adapter,
+                               const struct rx_sw_desc *sdesc)
 {
-        return FL_PG_ORDER > 0 && (sdesc->dma_addr & RX_LARGE_BUF)
-                ? (PAGE_SIZE << FL_PG_ORDER)
-                : PAGE_SIZE;
+        const struct sge *s = &adapter->sge;
+
+        return (s->fl_pg_order > 0 && (sdesc->dma_addr & RX_LARGE_BUF)
+                ? (PAGE_SIZE << s->fl_pg_order) : PAGE_SIZE);
 }
 
 /**
@@ -483,7 +476,8 @@ static void free_rx_bufs(struct adapter *adapter, struct sge_fl *fl, int n)
 
                 if (is_buf_mapped(sdesc))
                         dma_unmap_page(adapter->pdev_dev, get_buf_addr(sdesc),
-                                       get_buf_size(sdesc), PCI_DMA_FROMDEVICE);
+                                       get_buf_size(adapter, sdesc),
+                                       PCI_DMA_FROMDEVICE);
                 put_page(sdesc->page);
                 sdesc->page = NULL;
                 if (++fl->cidx == fl->size)
@@ -511,7 +505,8 @@ static void unmap_rx_buf(struct adapter *adapter, struct sge_fl *fl)
 
         if (is_buf_mapped(sdesc))
                 dma_unmap_page(adapter->pdev_dev, get_buf_addr(sdesc),
-                               get_buf_size(sdesc), PCI_DMA_FROMDEVICE);
+                               get_buf_size(adapter, sdesc),
+                               PCI_DMA_FROMDEVICE);
         sdesc->page = NULL;
         if (++fl->cidx == fl->size)
                 fl->cidx = 0;
@@ -589,6 +584,7 @@ static inline void poison_buf(struct page *page, size_t sz)
 static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                               int n, gfp_t gfp)
 {
+        struct sge *s = &adapter->sge;
         struct page *page;
         dma_addr_t dma_addr;
         unsigned int cred = fl->avail;
@@ -608,12 +604,12 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
          * If we don't support large pages, drop directly into the small page
          * allocation code.
          */
-        if (FL_PG_ORDER == 0)
+        if (s->fl_pg_order == 0)
                 goto alloc_small_pages;
 
         while (n) {
                 page = alloc_pages(gfp | __GFP_COMP | __GFP_NOWARN,
-                                   FL_PG_ORDER);
+                                   s->fl_pg_order);
                 if (unlikely(!page)) {
                         /*
                          * We've failed inour attempt to allocate a "large
@@ -623,10 +619,10 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                         fl->large_alloc_failed++;
                         break;
                 }
-                poison_buf(page, PAGE_SIZE << FL_PG_ORDER);
+                poison_buf(page, PAGE_SIZE << s->fl_pg_order);
 
                 dma_addr = dma_map_page(adapter->pdev_dev, page, 0,
-                                        PAGE_SIZE << FL_PG_ORDER,
+                                        PAGE_SIZE << s->fl_pg_order,
                                         PCI_DMA_FROMDEVICE);
                 if (unlikely(dma_mapping_error(adapter->pdev_dev, dma_addr))) {
                         /*
@@ -637,7 +633,7 @@ static unsigned int refill_fl(struct adapter *adapter, struct sge_fl *fl,
                          * because DMA mapping resources are typically
                          * critical resources once they become scarse.
                          */
-                        __free_pages(page, FL_PG_ORDER);
+                        __free_pages(page, s->fl_pg_order);
                         goto out;
                 }
                 dma_addr |= RX_LARGE_BUF;
@@ -693,7 +689,7 @@ out:
         fl->pend_cred += cred;
         ring_fl_db(adapter, fl);
 
-        if (unlikely(fl_starving(fl))) {
+        if (unlikely(fl_starving(adapter, fl))) {
                 smp_wmb();
                 set_bit(fl->cntxt_id, adapter->sge.starving_fl);
         }
@@ -1468,6 +1464,8 @@ static void t4vf_pktgl_free(const struct pkt_gl *gl)
 static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
                    const struct cpl_rx_pkt *pkt)
 {
+        struct adapter *adapter = rxq->rspq.adapter;
+        struct sge *s = &adapter->sge;
         int ret;
         struct sk_buff *skb;
 
@@ -1478,8 +1476,8 @@ static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
                 return;
         }
 
-        copy_frags(skb, gl, PKTSHIFT);
-        skb->len = gl->tot_len - PKTSHIFT;
+        copy_frags(skb, gl, s->pktshift);
+        skb->len = gl->tot_len - s->pktshift;
         skb->data_len = skb->len;
         skb->truesize += skb->data_len;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -1516,6 +1514,8 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
         bool csum_ok = pkt->csum_calc && !pkt->err_vec &&
                        (rspq->netdev->features & NETIF_F_RXCSUM);
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
+        struct adapter *adapter = rspq->adapter;
+        struct sge *s = &adapter->sge;
 
         /*
          * If this is a good TCP packet and we have Generic Receive Offload
@@ -1537,7 +1537,7 @@ int t4vf_ethrx_handler(struct sge_rspq *rspq, const __be64 *rsp,
                 rxq->stats.rx_drops++;
                 return 0;
         }
-        __skb_pull(skb, PKTSHIFT);
+        __skb_pull(skb, s->pktshift);
         skb->protocol = eth_type_trans(skb, rspq->netdev);
         skb_record_rx_queue(skb, rspq->idx);
         rxq->stats.pkts++;
@@ -1648,6 +1648,8 @@ static inline void rspq_next(struct sge_rspq *rspq)
 static int process_responses(struct sge_rspq *rspq, int budget)
 {
         struct sge_eth_rxq *rxq = container_of(rspq, struct sge_eth_rxq, rspq);
+        struct adapter *adapter = rspq->adapter;
+        struct sge *s = &adapter->sge;
         int budget_left = budget;
 
         while (likely(budget_left)) {
@@ -1697,7 +1699,7 @@ static int process_responses(struct sge_rspq *rspq, int budget)
                                 BUG_ON(frag >= MAX_SKB_FRAGS);
                                 BUG_ON(rxq->fl.avail == 0);
                                 sdesc = &rxq->fl.sdesc[rxq->fl.cidx];
-                                bufsz = get_buf_size(sdesc);
+                                bufsz = get_buf_size(adapter, sdesc);
                                 fp->page = sdesc->page;
                                 fp->offset = rspq->offset;
                                 fp->size = min(bufsz, len);
@@ -1726,7 +1728,7 @@ static int process_responses(struct sge_rspq *rspq, int budget)
                          */
                         ret = rspq->handler(rspq, rspq->cur_desc, &gl);
                         if (likely(ret == 0))
-                                rspq->offset += ALIGN(fp->size, FL_ALIGN);
+                                rspq->offset += ALIGN(fp->size, s->fl_align);
                         else
                                 restore_rx_bufs(&gl, &rxq->fl, frag);
                 } else if (likely(rsp_type == RSP_TYPE_CPL)) {
@@ -1963,7 +1965,7 @@ static void sge_rx_timer_cb(unsigned long data)
                          * schedule napi but the FL is no longer starving.
                          * No biggie.
                          */
-                        if (fl_starving(fl)) {
+                        if (fl_starving(adapter, fl)) {
                                 struct sge_eth_rxq *rxq;
 
                                 rxq = container_of(fl, struct sge_eth_rxq, fl);
@@ -2047,6 +2049,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                        int intr_dest,
                        struct sge_fl *fl, rspq_handler_t hnd)
 {
+        struct sge *s = &adapter->sge;
         struct port_info *pi = netdev_priv(dev);
         struct fw_iq_cmd cmd, rpl;
         int ret, iqandst, flsz = 0;
@@ -2117,7 +2120,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                 fl->size = roundup(fl->size, FL_PER_EQ_UNIT);
                 fl->desc = alloc_ring(adapter->pdev_dev, fl->size,
                                       sizeof(__be64), sizeof(struct rx_sw_desc),
-                                      &fl->addr, &fl->sdesc, STAT_LEN);
+                                      &fl->addr, &fl->sdesc, s->stat_len);
                 if (!fl->desc) {
                         ret = -ENOMEM;
                         goto err;
@@ -2129,7 +2132,7 @@ int t4vf_sge_alloc_rxq(struct adapter *adapter, struct sge_rspq *rspq,
                  * free list ring) in Egress Queue Units.
                  */
                 flsz = (fl->size / FL_PER_EQ_UNIT +
-                        STAT_LEN / EQ_UNIT);
+                        s->stat_len / EQ_UNIT);
 
                 /*
                  * Fill in all the relevant firmware Ingress Queue Command
@@ -2217,6 +2220,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
                            struct net_device *dev, struct netdev_queue *devq,
                            unsigned int iqid)
 {
+        struct sge *s = &adapter->sge;
         int ret, nentries;
         struct fw_eq_eth_cmd cmd, rpl;
         struct port_info *pi = netdev_priv(dev);
@@ -2225,7 +2229,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
          * Calculate the size of the hardware TX Queue (including the Status
          * Page on the end of the TX Queue) in units of TX Descriptors.
          */
-        nentries = txq->q.size + STAT_LEN / sizeof(struct tx_desc);
+        nentries = txq->q.size + s->stat_len / sizeof(struct tx_desc);
 
         /*
          * Allocate the hardware ring for the TX ring (with space for its
@@ -2234,7 +2238,7 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
         txq->q.desc = alloc_ring(adapter->pdev_dev, txq->q.size,
                                  sizeof(struct tx_desc),
                                  sizeof(struct tx_sw_desc),
-                                 &txq->q.phys_addr, &txq->q.sdesc, STAT_LEN);
+                                 &txq->q.phys_addr, &txq->q.sdesc, s->stat_len);
         if (!txq->q.desc)
                 return -ENOMEM;
 
@@ -2307,8 +2311,10 @@ int t4vf_sge_alloc_eth_txq(struct adapter *adapter, struct sge_eth_txq *txq,
  */
 static void free_txq(struct adapter *adapter, struct sge_txq *tq)
 {
+        struct sge *s = &adapter->sge;
+
         dma_free_coherent(adapter->pdev_dev,
-                          tq->size * sizeof(*tq->desc) + STAT_LEN,
+                          tq->size * sizeof(*tq->desc) + s->stat_len,
                           tq->desc, tq->phys_addr);
         tq->cntxt_id = 0;
         tq->sdesc = NULL;
@@ -2322,6 +2328,7 @@ static void free_txq(struct adapter *adapter, struct sge_txq *tq)
 static void free_rspq_fl(struct adapter *adapter, struct sge_rspq *rspq,
                          struct sge_fl *fl)
 {
+        struct sge *s = &adapter->sge;
         unsigned int flid = fl ? fl->cntxt_id : 0xffff;
 
         t4vf_iq_free(adapter, FW_IQ_TYPE_FL_INT_CAP,
@@ -2337,7 +2344,7 @@ static void free_rspq_fl(struct adapter *adapter, struct sge_rspq *rspq,
         if (fl) {
                 free_rx_bufs(adapter, fl, fl->avail);
                 dma_free_coherent(adapter->pdev_dev,
-                                  fl->size * sizeof(*fl->desc) + STAT_LEN,
+                                  fl->size * sizeof(*fl->desc) + s->stat_len,
                                   fl->desc, fl->addr);
                 kfree(fl->sdesc);
                 fl->sdesc = NULL;
@@ -2423,6 +2430,7 @@ int t4vf_sge_init(struct adapter *adapter)
         u32 fl0 = sge_params->sge_fl_buffer_size[0];
         u32 fl1 = sge_params->sge_fl_buffer_size[1];
         struct sge *s = &adapter->sge;
+        unsigned int ingpadboundary, ingpackboundary;
 
         /*
          * Start by vetting the basic SGE parameters which have been set up by
@@ -2443,12 +2451,48 @@ int t4vf_sge_init(struct adapter *adapter)
          * Now translate the adapter parameters into our internal forms.
          */
         if (fl1)
-                FL_PG_ORDER = ilog2(fl1) - PAGE_SHIFT;
-        STAT_LEN = ((sge_params->sge_control & EGRSTATUSPAGESIZE_MASK)
-                    ? 128 : 64);
-        PKTSHIFT = PKTSHIFT_GET(sge_params->sge_control);
-        FL_ALIGN = 1 << (INGPADBOUNDARY_GET(sge_params->sge_control) +
-                         SGE_INGPADBOUNDARY_SHIFT);
+                s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT;
+        s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_MASK)
+                        ? 128 : 64);
+        s->pktshift = PKTSHIFT_GET(sge_params->sge_control);
+
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately.  The actual Ingress Packet Data alignment boundary
+         * within Packed Buffer Mode is the maximum of these two
+         * specifications.  (Note that it makes no real practical sense to
+         * have the Pading Boudary be larger than the Packing Boundary but you
+         * could set the chip up that way and, in fact, legacy T4 code would
+         * end doing this because it would initialize the Padding Boundary and
+         * leave the Packing Boundary initialized to 0 (16 bytes).)
+         */
+        ingpadboundary = 1 << (INGPADBOUNDARY_GET(sge_params->sge_control) +
+                               X_INGPADBOUNDARY_SHIFT);
+        if (is_t4(adapter->params.chip)) {
+                s->fl_align = ingpadboundary;
+        } else {
+                /* T5 has a different interpretation of one of the PCIe Packing
+                 * Boundary values.
+                 */
+                ingpackboundary = INGPACKBOUNDARY_G(sge_params->sge_control2);
+                if (ingpackboundary == INGPACKBOUNDARY_16B_X)
+                        ingpackboundary = 16;
+                else
+                        ingpackboundary = 1 << (ingpackboundary +
+                                                INGPACKBOUNDARY_SHIFT_X);
+
+                s->fl_align = max(ingpadboundary, ingpackboundary);
+        }
+
+        /* A FL with <= fl_starve_thres buffers is starving and a periodic
+         * timer will attempt to refill it.  This needs to be larger than the
+         * SGE's Egress Congestion Threshold.  If it isn't, then we can get
+         * stuck waiting for new packets while the SGE is waiting for us to
+         * give it more Free List entries.  (Note that the SGE's Egress
+         * Congestion Threshold is in units of 2 Free List pointers.)
+         */
+        s->fl_starve_thres
+                = EGRTHRESHOLD_GET(sge_params->sge_congestion_control)*2 + 1;
 
         /*
          * Set up tasklet timers.
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
index 95df61dcb4ce..4b6a6d14d86d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_common.h
@@ -134,11 +134,13 @@ struct dev_params {
  */
 struct sge_params {
         u32 sge_control;                /* padding, boundaries, lengths, etc. */
+        u32 sge_control2;               /* T5: more of the same */
         u32 sge_host_page_size;         /* RDMA page sizes */
         u32 sge_queues_per_page;        /* RDMA queues/page */
         u32 sge_user_mode_limits;       /* limits for BAR2 user mode accesses */
         u32 sge_fl_buffer_size[16];     /* free list buffer sizes */
         u32 sge_ingress_rx_threshold;   /* RX counter interrupt threshold[4] */
+        u32 sge_congestion_control;     /* congestion thresholds, etc. */
         u32 sge_timer_value_0_and_1;    /* interrupt coalescing timer values */
         u32 sge_timer_value_2_and_3;
         u32 sge_timer_value_4_and_5;
diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
index e984fdc48ba2..1e896b923234 100644
--- a/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4vf/t4vf_hw.c
@@ -468,12 +468,38 @@ int t4vf_get_sge_params(struct adapter *adapter)
         sge_params->sge_timer_value_2_and_3 = vals[5];
         sge_params->sge_timer_value_4_and_5 = vals[6];
 
+        /* T4 uses a single control field to specify both the PCIe Padding and
+         * Packing Boundary.  T5 introduced the ability to specify these
+         * separately with the Padding Boundary in SGE_CONTROL and and Packing
+         * Boundary in SGE_CONTROL2.  So for T5 and later we need to grab
+         * SGE_CONTROL in order to determine how ingress packet data will be
+         * laid out in Packed Buffer Mode.  Unfortunately, older versions of
+         * the firmware won't let us retrieve SGE_CONTROL2 so if we get a
+         * failure grabbing it we throw an error since we can't figure out the
+         * right value.
+         */
+        if (!is_t4(adapter->params.chip)) {
+                params[0] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
+                             FW_PARAMS_PARAM_XYZ(SGE_CONTROL2_A));
+                v = t4vf_query_params(adapter, 1, params, vals);
+                if (v != FW_SUCCESS) {
+                        dev_err(adapter->pdev_dev,
+                                "Unable to get SGE Control2; "
+                                "probably old firmware.\n");
+                        return v;
+                }
+                sge_params->sge_control2 = vals[0];
+        }
+
         params[0] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
                      FW_PARAMS_PARAM_XYZ(SGE_INGRESS_RX_THRESHOLD));
-        v = t4vf_query_params(adapter, 1, params, vals);
+        params[1] = (FW_PARAMS_MNEM(FW_PARAMS_MNEM_REG) |
+                     FW_PARAMS_PARAM_XYZ(SGE_CONM_CTRL));
+        v = t4vf_query_params(adapter, 2, params, vals);
         if (v)
                 return v;
         sge_params->sge_ingress_rx_threshold = vals[0];
+        sge_params->sge_congestion_control = vals[1];
 
         return 0;
 }
diff --git a/drivers/net/ethernet/cisco/enic/enic_clsf.c b/drivers/net/ethernet/cisco/enic/enic_clsf.c
index 69dfd3c9e529..0be6850be8a2 100644
--- a/drivers/net/ethernet/cisco/enic/enic_clsf.c
+++ b/drivers/net/ethernet/cisco/enic/enic_clsf.c
@@ -86,7 +86,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
         int i;
 
         enic_rfs_timer_stop(enic);
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         enic->rfs_h.free = 0;
         for (i = 0; i < (1 << ENIC_RFS_FLW_BITSHIFT); i++) {
                 struct hlist_head *hhead;
@@ -100,7 +100,7 @@ void enic_rfs_flw_tbl_free(struct enic *enic)
                         kfree(n);
                 }
         }
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
 }
 
 struct enic_rfs_fltr_node *htbl_fltr_search(struct enic *enic, u16 fltr_id)
@@ -128,7 +128,7 @@ void enic_flow_may_expire(unsigned long data)
         bool res;
         int j;
 
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         for (j = 0; j < ENIC_CLSF_EXPIRE_COUNT; j++) {
                 struct hlist_head *hhead;
                 struct hlist_node *tmp;
@@ -148,7 +148,7 @@ void enic_flow_may_expire(unsigned long data)
                         }
                 }
         }
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
         mod_timer(&enic->rfs_h.rfs_may_expire, jiffies + HZ/4);
 }
 
@@ -183,7 +183,7 @@ int enic_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
                 return -EPROTONOSUPPORT;
 
         tbl_idx = skb_get_hash_raw(skb) & ENIC_RFS_FLW_MASK;
-        spin_lock(&enic->rfs_h.lock);
+        spin_lock_bh(&enic->rfs_h.lock);
         n = htbl_key_search(&enic->rfs_h.ht_head[tbl_idx], &keys);
 
         if (n) { /* entry already present  */
@@ -277,7 +277,7 @@ int enic_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb,
         }
 
 ret_unlock:
-        spin_unlock(&enic->rfs_h.lock);
+        spin_unlock_bh(&enic->rfs_h.lock);
         return res;
 }
 
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index 929bfe70080a..73cf1653a4a3 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -940,18 +940,8 @@ static int enic_rq_alloc_buf(struct vnic_rq *rq)
         struct vnic_rq_buf *buf = rq->to_use;
 
         if (buf->os_buf) {
-                buf = buf->next;
-                rq->to_use = buf;
-                rq->ring.desc_avail--;
-                if ((buf->index & VNIC_RQ_RETURN_RATE) == 0) {
-                        /* Adding write memory barrier prevents compiler and/or
-                         * CPU reordering, thus avoiding descriptor posting
-                         * before descriptor is initialized. Otherwise, hardware
-                         * can read stale descriptor fields.
-                         */
-                        wmb();
-                        iowrite32(buf->index, &rq->ctrl->posted_index);
-                }
+                enic_queue_rq_desc(rq, buf->os_buf, os_buf_index, buf->dma_addr,
+                                   buf->len);
 
                 return 0;
         }
@@ -1037,7 +1027,10 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                                 enic->rq_truncated_pkts++;
                 }
 
+                pci_unmap_single(enic->pdev, buf->dma_addr, buf->len,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(skb);
+                buf->os_buf = NULL;
 
                 return;
         }
@@ -1088,7 +1081,10 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
                 /* Buffer overflow
                  */
 
+                pci_unmap_single(enic->pdev, buf->dma_addr, buf->len,
+                                 PCI_DMA_FROMDEVICE);
                 dev_kfree_skb_any(skb);
+                buf->os_buf = NULL;
         }
 }
 
@@ -1674,13 +1670,13 @@ static int enic_stop(struct net_device *netdev)
 
         enic_dev_disable(enic);
 
-        local_bh_disable();
         for (i = 0; i < enic->rq_count; i++) {
                 napi_disable(&enic->napi[i]);
+                local_bh_disable();
                 while (!enic_poll_lock_napi(&enic->rq[i]))
                         mdelay(1);
+                local_bh_enable();
         }
-        local_bh_enable();
 
         netif_carrier_off(netdev);
         netif_tx_disable(netdev);
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 9a18e7930b31..3e8475cae4f9 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4421,6 +4421,11 @@ static void be_del_vxlan_port(struct net_device *netdev, sa_family_t sa_family,
                  "Disabled VxLAN offloads for UDP port %d\n",
                  be16_to_cpu(port));
 }
+
+static bool be_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops be_netdev_ops = {
@@ -4450,6 +4455,7 @@ static const struct net_device_ops be_netdev_ops = {
 #ifdef CONFIG_BE2NET_VXLAN
         .ndo_add_vxlan_port     = be_add_vxlan_port,
         .ndo_del_vxlan_port     = be_del_vxlan_port,
+        .ndo_gso_check          = be_gso_check,
 #endif
 };
 
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 81b96cf87574..3dca494797bd 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -298,6 +298,16 @@ static void *swap_buffer(void *bufaddr, int len)
         return bufaddr;
 }
 
+static void swap_buffer2(void *dst_buf, void *src_buf, int len)
+{
+        int i;
+        unsigned int *src = src_buf;
+        unsigned int *dst = dst_buf;
+
+        for (i = 0; i < len; i += 4, src++, dst++)
+                *dst = swab32p(src);
+}
+
 static void fec_dump(struct net_device *ndev)
 {
         struct fec_enet_private *fep = netdev_priv(ndev);
@@ -1307,7 +1317,7 @@ fec_enet_new_rxbdp(struct net_device *ndev, struct bufdesc *bdp, struct sk_buff
 }
 
 static bool fec_enet_copybreak(struct net_device *ndev, struct sk_buff **skb,
-                               struct bufdesc *bdp, u32 length)
+                               struct bufdesc *bdp, u32 length, bool swap)
 {
         struct  fec_enet_private *fep = netdev_priv(ndev);
         struct sk_buff *new_skb;
@@ -1322,7 +1332,10 @@ static bool fec_enet_copybreak(struct net_device *ndev, struct sk_buff **skb,
         dma_sync_single_for_cpu(&fep->pdev->dev, bdp->cbd_bufaddr,
                                 FEC_ENET_RX_FRSIZE - fep->rx_align,
                                 DMA_FROM_DEVICE);
-        memcpy(new_skb->data, (*skb)->data, length);
+        if (!swap)
+                memcpy(new_skb->data, (*skb)->data, length);
+        else
+                swap_buffer2(new_skb->data, (*skb)->data, length);
         *skb = new_skb;
 
         return true;
@@ -1352,6 +1365,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
         u16     vlan_tag;
         int     index = 0;
         bool    is_copybreak;
+        bool    need_swap = id_entry->driver_data & FEC_QUIRK_SWAP_FRAME;
 
 #ifdef CONFIG_M532x
         flush_cache_all();
@@ -1415,7 +1429,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                  * include that when passing upstream as it messes up
                  * bridging applications.
                  */
-                is_copybreak = fec_enet_copybreak(ndev, &skb, bdp, pkt_len - 4);
+                is_copybreak = fec_enet_copybreak(ndev, &skb, bdp, pkt_len - 4,
+                                                  need_swap);
                 if (!is_copybreak) {
                         skb_new = netdev_alloc_skb(ndev, FEC_ENET_RX_FRSIZE);
                         if (unlikely(!skb_new)) {
@@ -1430,7 +1445,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
                 prefetch(skb->data - NET_IP_ALIGN);
                 skb_put(skb, pkt_len - 4);
                 data = skb->data;
-                if (id_entry->driver_data & FEC_QUIRK_SWAP_FRAME)
+                if (!is_copybreak && need_swap)
                         swap_buffer(data, pkt_len);
 
                 /* Extract the enhanced buffer descriptor */
@@ -1581,7 +1596,8 @@ fec_enet_interrupt(int irq, void *dev_id)
                 complete(&fep->mdio_done);
         }
 
-        fec_ptp_check_pps_event(fep);
+        if (fep->ptp_clock)
+                fec_ptp_check_pps_event(fep);
 
         return ret;
 }
@@ -3342,12 +3358,11 @@ static int __maybe_unused fec_suspend(struct device *dev)
                 netif_device_detach(ndev);
                 netif_tx_unlock_bh(ndev);
                 fec_stop(ndev);
+                fec_enet_clk_enable(ndev, false);
+                pinctrl_pm_select_sleep_state(&fep->pdev->dev);
         }
         rtnl_unlock();
 
-        fec_enet_clk_enable(ndev, false);
-        pinctrl_pm_select_sleep_state(&fep->pdev->dev);
-
         if (fep->reg_phy)
                 regulator_disable(fep->reg_phy);
 
@@ -3366,13 +3381,14 @@ static int __maybe_unused fec_resume(struct device *dev)
                         return ret;
         }
 
-        pinctrl_pm_select_default_state(&fep->pdev->dev);
-        ret = fec_enet_clk_enable(ndev, true);
-        if (ret)
-                goto failed_clk;
-
         rtnl_lock();
         if (netif_running(ndev)) {
+                pinctrl_pm_select_default_state(&fep->pdev->dev);
+                ret = fec_enet_clk_enable(ndev, true);
+                if (ret) {
+                        rtnl_unlock();
+                        goto failed_clk;
+                }
                 fec_restart(ndev);
                 netif_tx_lock_bh(ndev);
                 netif_device_attach(ndev);
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
index 3d4e08be1709..b34214e2df5f 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-fec.c
@@ -341,6 +341,9 @@ static void restart(struct net_device *dev)
                 FC(fecp, x_cntrl, FEC_TCNTRL_FDEN);     /* FD disable */
         }
 
+        /* Restore multicast and promiscuous settings */
+        set_multicast_list(dev);
+
         /*
          * Enable interrupts we wish to service.
          */
diff --git a/drivers/net/ethernet/freescale/fs_enet/mac-scc.c b/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
index f30411f0701f..7a184e8816a4 100644
--- a/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
+++ b/drivers/net/ethernet/freescale/fs_enet/mac-scc.c
@@ -355,6 +355,9 @@ static void restart(struct net_device *dev)
         if (fep->phydev->duplex)
                 S16(sccp, scc_psmr, SCC_PSMR_LPB | SCC_PSMR_FDE);
 
+        /* Restore multicast and promiscuous settings */
+        set_multicast_list(dev);
+
         S32(sccp, scc_gsmrl, SCC_GSMRL_ENR | SCC_GSMRL_ENT);
 }
 
diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
index 5f6aded512f5..24f3986cfae2 100644
--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
@@ -1075,7 +1075,10 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                                   NETIF_F_HW_CSUM |
                                   NETIF_F_SG);
 
-        netdev->priv_flags |= IFF_UNICAST_FLT;
+        /* Do not set IFF_UNICAST_FLT for VMWare's 82545EM */
+        if (hw->device_id != E1000_DEV_ID_82545EM_COPPER ||
+            hw->subsystem_vendor_id != PCI_VENDOR_ID_VMWARE)
+                netdev->priv_flags |= IFF_UNICAST_FLT;
 
         adapter->en_mng_pt = e1000_enable_mng_pass_thru(hw);
 
diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index ed5f1c15fb0f..c3a7f4a4b775 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
@@ -6151,7 +6151,7 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
                                 I40E_GL_MDET_TX_PF_NUM_SHIFT;
                 u8 vf_num = (reg & I40E_GL_MDET_TX_VF_NUM_MASK) >>
                                 I40E_GL_MDET_TX_VF_NUM_SHIFT;
-                u8 event = (reg & I40E_GL_MDET_TX_EVENT_SHIFT) >>
+                u8 event = (reg & I40E_GL_MDET_TX_EVENT_MASK) >>
                                 I40E_GL_MDET_TX_EVENT_SHIFT;
                 u8 queue = (reg & I40E_GL_MDET_TX_QUEUE_MASK) >>
                                 I40E_GL_MDET_TX_QUEUE_SHIFT;
@@ -6165,7 +6165,7 @@ static void i40e_handle_mdd_event(struct i40e_pf *pf)
         if (reg & I40E_GL_MDET_RX_VALID_MASK) {
                 u8 func = (reg & I40E_GL_MDET_RX_FUNCTION_MASK) >>
                                 I40E_GL_MDET_RX_FUNCTION_SHIFT;
-                u8 event = (reg & I40E_GL_MDET_RX_EVENT_SHIFT) >>
+                u8 event = (reg & I40E_GL_MDET_RX_EVENT_MASK) >>
                                 I40E_GL_MDET_RX_EVENT_SHIFT;
                 u8 queue = (reg & I40E_GL_MDET_RX_QUEUE_MASK) >>
                                 I40E_GL_MDET_RX_QUEUE_SHIFT;
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index a21b14495ebd..a2d72a87cbde 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -6537,6 +6537,9 @@ static bool igb_can_reuse_rx_page(struct igb_rx_buffer *rx_buffer,
         if (unlikely(page_to_nid(page) != numa_node_id()))
                 return false;
 
+        if (unlikely(page->pfmemalloc))
+                return false;
+
 #if (PAGE_SIZE < 8192)
         /* if we are only owner of page we can reuse it */
         if (unlikely(page_count(page) != 1))
@@ -6603,7 +6606,8 @@ static bool igb_add_rx_frag(struct igb_ring *rx_ring,
                 memcpy(__skb_put(skb, size), va, ALIGN(size, sizeof(long)));
 
                 /* we can reuse buffer as-is, just make sure it is local */
-                if (likely(page_to_nid(page) == numa_node_id()))
+                if (likely((page_to_nid(page) == numa_node_id()) &&
+                           !page->pfmemalloc))
                         return true;
 
                 /* this page cannot be reused so discard it */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 3ce4a258f945..0ae038b9af90 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -342,12 +342,16 @@ static int ixgbe_set_settings(struct net_device *netdev,
                 if (old == advertised)
                         return err;
                 /* this sets the link speed and restarts auto-neg */
+                while (test_and_set_bit(__IXGBE_IN_SFP_INIT, &adapter->state))
+                        usleep_range(1000, 2000);
+
                 hw->mac.autotry_restart = true;
                 err = hw->mac.ops.setup_link(hw, advertised, true);
                 if (err) {
                         e_info(probe, "setup link failed with code %d\n", err);
                         hw->mac.ops.setup_link(hw, old, true);
                 }
+                clear_bit(__IXGBE_IN_SFP_INIT, &adapter->state);
         } else {
                 /* in this case we currently only support 10Gb/FULL */
                 u32 speed = ethtool_cmd_speed(ecmd);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index fec5212d4337..d2df4e3d1032 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4321,8 +4321,8 @@ static void ixgbe_clean_rx_ring(struct ixgbe_ring *rx_ring)
                                 IXGBE_CB(skb)->page_released = false;
                         }
                         dev_kfree_skb(skb);
+                        rx_buffer->skb = NULL;
                 }
-                rx_buffer->skb = NULL;
                 if (rx_buffer->dma)
                         dma_unmap_page(dev, rx_buffer->dma,
                                        ixgbe_rx_pg_size(rx_ring),
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
index d47b19f27c35..28b81ae09b5a 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c
@@ -635,7 +635,6 @@ s32 ixgbe_check_phy_link_tnx(struct ixgbe_hw *hw, ixgbe_link_speed *speed,
  **/
 s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
 {
-        s32 status;
         u16 autoneg_reg = IXGBE_MII_AUTONEG_REG;
         bool autoneg = false;
         ixgbe_link_speed speed;
@@ -700,8 +699,7 @@ s32 ixgbe_setup_phy_link_tnx(struct ixgbe_hw *hw)
 
         hw->phy.ops.write_reg(hw, MDIO_CTRL1,
                               MDIO_MMD_AN, autoneg_reg);
-
-        return status;
+        return 0;
 }
 
 /**
diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
index b151a949f352..d44560d1d268 100644
--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
+++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
@@ -1047,7 +1047,6 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 int tx_index;
                 struct tx_desc *desc;
                 u32 cmd_sts;
-                struct sk_buff *skb;
 
                 tx_index = txq->tx_used_desc;
                 desc = &txq->tx_desc_area[tx_index];
@@ -1066,19 +1065,22 @@ static int txq_reclaim(struct tx_queue *txq, int budget, int force)
                 reclaimed++;
                 txq->tx_desc_count--;
 
-                skb = NULL;
-                if (cmd_sts & TX_LAST_DESC)
-                        skb = __skb_dequeue(&txq->tx_skb);
+                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
+                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
+                                         desc->byte_cnt, DMA_TO_DEVICE);
+
+                if (cmd_sts & TX_ENABLE_INTERRUPT) {
+                        struct sk_buff *skb = __skb_dequeue(&txq->tx_skb);
+
+                        if (!WARN_ON(!skb))
+                                dev_kfree_skb(skb);
+                }
 
                 if (cmd_sts & ERROR_SUMMARY) {
                         netdev_info(mp->dev, "tx error\n");
                         mp->dev->stats.tx_errors++;
                 }
 
-                if (!IS_TSO_HEADER(txq, desc->buf_ptr))
-                        dma_unmap_single(mp->dev->dev.parent, desc->buf_ptr,
-                                         desc->byte_cnt, DMA_TO_DEVICE);
-                dev_kfree_skb(skb);
         }
 
         __netif_tx_unlock_bh(nq);
diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
index ece83f101526..fdf3e382e464 100644
--- a/drivers/net/ethernet/marvell/mvpp2.c
+++ b/drivers/net/ethernet/marvell/mvpp2.c
@@ -1692,6 +1692,7 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
 {
         struct mvpp2_prs_entry *pe;
         int tid_aux, tid;
+        int ret = 0;
 
         pe = mvpp2_prs_vlan_find(priv, tpid, ai);
 
@@ -1723,8 +1724,10 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
                                 break;
                 }
 
-                if (tid <= tid_aux)
-                        return -EINVAL;
+                if (tid <= tid_aux) {
+                        ret = -EINVAL;
+                        goto error;
+                }
 
                 memset(pe, 0 , sizeof(struct mvpp2_prs_entry));
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_VLAN);
@@ -1756,9 +1759,10 @@ static int mvpp2_prs_vlan_add(struct mvpp2 *priv, unsigned short tpid, int ai,
 
         mvpp2_prs_hw_write(priv, pe);
 
+error:
         kfree(pe);
 
-        return 0;
+        return ret;
 }
 
 /* Get first free double vlan ai number */
@@ -1821,7 +1825,7 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
                                      unsigned int port_map)
 {
         struct mvpp2_prs_entry *pe;
-        int tid_aux, tid, ai;
+        int tid_aux, tid, ai, ret = 0;
 
         pe = mvpp2_prs_double_vlan_find(priv, tpid1, tpid2);
 
@@ -1838,8 +1842,10 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
 
                 /* Set ai value for new double vlan entry */
                 ai = mvpp2_prs_double_vlan_ai_free_get(priv);
-                if (ai < 0)
-                        return ai;
+                if (ai < 0) {
+                        ret = ai;
+                        goto error;
+                }
 
                 /* Get first single/triple vlan tid */
                 for (tid_aux = MVPP2_PE_FIRST_FREE_TID;
@@ -1859,8 +1865,10 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
                                 break;
                 }
 
-                if (tid >= tid_aux)
-                        return -ERANGE;
+                if (tid >= tid_aux) {
+                        ret = -ERANGE;
+                        goto error;
+                }
 
                 memset(pe, 0, sizeof(struct mvpp2_prs_entry));
                 mvpp2_prs_tcam_lu_set(pe, MVPP2_PRS_LU_VLAN);
@@ -1887,8 +1895,9 @@ static int mvpp2_prs_double_vlan_add(struct mvpp2 *priv, unsigned short tpid1,
         mvpp2_prs_tcam_port_map_set(pe, port_map);
         mvpp2_prs_hw_write(priv, pe);
 
+error:
         kfree(pe);
-        return 0;
+        return ret;
 }
 
 /* IPv4 header parsing for fragmentation and L4 offset */
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index f3032fec8fce..4d69e382b4e5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -1693,7 +1693,7 @@ int mlx4_en_start_port(struct net_device *dev)
         mlx4_set_stats_bitmap(mdev->dev, &priv->stats_bitmap);
 
 #ifdef CONFIG_MLX4_EN_VXLAN
-        if (priv->mdev->dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_VXLAN_OFFLOADS)
+        if (priv->mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN)
                 vxlan_get_rx_port(dev);
 #endif
         priv->port_up = true;
@@ -2281,8 +2281,16 @@ static void mlx4_en_add_vxlan_offloads(struct work_struct *work)
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 1);
 out:
-        if (ret)
+        if (ret) {
                 en_err(priv, "failed setting L2 tunnel configuration ret %d\n", ret);
+                return;
+        }
+
+        /* set offloads */
+        priv->dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+                                      NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
 }
 
 static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
@@ -2290,6 +2298,11 @@ static void mlx4_en_del_vxlan_offloads(struct work_struct *work)
         int ret;
         struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv,
                                                  vxlan_del_task);
+        /* unset offloads */
+        priv->dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+                                      NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL);
+        priv->dev->hw_features &= ~NETIF_F_GSO_UDP_TUNNEL;
+        priv->dev->features    &= ~NETIF_F_GSO_UDP_TUNNEL;
 
         ret = mlx4_SET_PORT_VXLAN(priv->mdev->dev, priv->port,
                                   VXLAN_STEER_BY_OUTER_MAC, 0);
@@ -2342,6 +2355,11 @@ static void mlx4_en_del_vxlan_port(struct  net_device *dev,
 
         queue_work(priv->mdev->workqueue, &priv->vxlan_del_task);
 }
+
+static bool mlx4_en_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops mlx4_netdev_ops = {
@@ -2373,6 +2391,7 @@ static const struct net_device_ops mlx4_netdev_ops = {
 #ifdef CONFIG_MLX4_EN_VXLAN
         .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
         .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
 #endif
 };
 
@@ -2403,6 +2422,11 @@ static const struct net_device_ops mlx4_netdev_ops_master = {
         .ndo_rx_flow_steer      = mlx4_en_filter_rfs,
 #endif
         .ndo_get_phys_port_id   = mlx4_en_get_phys_port_id,
+#ifdef CONFIG_MLX4_EN_VXLAN
+        .ndo_add_vxlan_port     = mlx4_en_add_vxlan_port,
+        .ndo_del_vxlan_port     = mlx4_en_del_vxlan_port,
+        .ndo_gso_check          = mlx4_en_gso_check,
+#endif
 };
 
 int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
@@ -2568,13 +2592,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port,
         if (mdev->dev->caps.steering_mode != MLX4_STEERING_MODE_A0)
                 dev->priv_flags |= IFF_UNICAST_FLT;
 
-        if (mdev->dev->caps.tunnel_offload_mode == MLX4_TUNNEL_OFFLOAD_MODE_VXLAN) {
-                dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
-                                        NETIF_F_TSO | NETIF_F_GSO_UDP_TUNNEL;
-                dev->hw_features |= NETIF_F_GSO_UDP_TUNNEL;
-                dev->features    |= NETIF_F_GSO_UDP_TUNNEL;
-        }
-
         mdev->pndev[port] = dev;
 
         netif_carrier_off(dev);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 34c137878545..454d9fea640e 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -836,8 +836,11 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
          * whether LSO is used */
         tx_desc->ctrl.srcrb_flags = priv->ctrl_flags;
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL)) {
-                tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM |
-                                                         MLX4_WQE_CTRL_TCP_UDP_CSUM);
+                if (!skb->encapsulation)
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM |
+                                                                 MLX4_WQE_CTRL_TCP_UDP_CSUM);
+                else
+                        tx_desc->ctrl.srcrb_flags |= cpu_to_be32(MLX4_WQE_CTRL_IP_CSUM);
                 ring->tx_csum++;
         }
 
diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c
index a49c9d11d8a5..49290a405903 100644
--- a/drivers/net/ethernet/mellanox/mlx4/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c
@@ -1026,6 +1026,7 @@ static void mlx4_free_eq(struct mlx4_dev *dev,
                                 pr_cont("\n");
                 }
         }
+        synchronize_irq(eq->irq);
 
         mlx4_mtt_cleanup(dev, &eq->mtt);
         for (i = 0; i < npages; ++i)
diff --git a/drivers/net/ethernet/mellanox/mlx4/mcg.c b/drivers/net/ethernet/mellanox/mlx4/mcg.c
index ca0f98c95105..872843179f44 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mcg.c
+++ b/drivers/net/ethernet/mellanox/mlx4/mcg.c
@@ -955,6 +955,10 @@ static void mlx4_err_rule(struct mlx4_dev *dev, char *str,
                                         cur->ib.dst_gid_msk);
                         break;
 
+                case MLX4_NET_TRANS_RULE_ID_VXLAN:
+                        len += snprintf(buf + len, BUF_SIZE - len,
+                                        "VNID = %d ", be32_to_cpu(cur->vxlan.vni));
+                        break;
                 case MLX4_NET_TRANS_RULE_ID_IPV6:
                         break;
 
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
index ed53291468f3..ad2c96a02a53 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c
@@ -374,15 +374,14 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx,
         snprintf(eq->name, MLX5_MAX_EQ_NAME, "%s@pci:%s",
                  name, pci_name(dev->pdev));
         eq->eqn = out.eq_number;
+        eq->irqn = vecidx;
+        eq->dev = dev;
+        eq->doorbell = uar->map + MLX5_EQ_DOORBEL_OFFSET;
         err = request_irq(table->msix_arr[vecidx].vector, mlx5_msix_handler, 0,
                           eq->name, eq);
         if (err)
                 goto err_eq;
 
-        eq->irqn = vecidx;
-        eq->dev = dev;
-        eq->doorbell = uar->map + MLX5_EQ_DOORBEL_OFFSET;
-
         err = mlx5_debug_eq_add(dev, eq);
         if (err)
                 goto err_irq;
@@ -420,6 +419,7 @@ int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq)
         if (err)
                 mlx5_core_warn(dev, "failed to destroy a previously created eq: eqn %d\n",
                                eq->eqn);
+        synchronize_irq(table->msix_arr[eq->irqn].vector);
         mlx5_buf_free(dev, &eq->buf);
 
         return err;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 3d8e8e489b2d..71b10b210792 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -864,14 +864,14 @@ static int init_one(struct pci_dev *pdev,
         dev->profile = &profile[prof_sel];
         dev->event = mlx5_core_event;
 
+        INIT_LIST_HEAD(&priv->ctx_list);
+        spin_lock_init(&priv->ctx_lock);
         err = mlx5_dev_init(dev, pdev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_dev_init failed %d\n", err);
                 goto out;
         }
 
-        INIT_LIST_HEAD(&priv->ctx_list);
-        spin_lock_init(&priv->ctx_lock);
         err = mlx5_register_device(dev);
         if (err) {
                 dev_err(&pdev->dev, "mlx5_register_device failed %d\n", err);
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 0b2a1ccd276d..613037584d08 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -2762,7 +2762,8 @@ netxen_fw_poll_work(struct work_struct *work)
         if (test_bit(__NX_RESETTING, &adapter->state))
                 goto reschedule;
 
-        if (test_bit(__NX_DEV_UP, &adapter->state)) {
+        if (test_bit(__NX_DEV_UP, &adapter->state) &&
+            !(adapter->capabilities & NX_FW_CAPABILITY_LINK_NOTIFICATION)) {
                 if (!adapter->has_link_events) {
 
                         netxen_nic_handle_phy_intr(adapter);
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index f5e29f7bdae3..a913b3ad2f89 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -503,6 +503,11 @@ static void qlcnic_del_vxlan_port(struct net_device *netdev,
 
         adapter->flags |= QLCNIC_DEL_VXLAN_PORT;
 }
+
+static bool qlcnic_gso_check(struct sk_buff *skb, struct net_device *dev)
+{
+        return vxlan_gso_check(skb);
+}
 #endif
 
 static const struct net_device_ops qlcnic_netdev_ops = {
@@ -526,6 +531,7 @@ static const struct net_device_ops qlcnic_netdev_ops = {
 #ifdef CONFIG_QLCNIC_VXLAN
         .ndo_add_vxlan_port     = qlcnic_add_vxlan_port,
         .ndo_del_vxlan_port     = qlcnic_del_vxlan_port,
+        .ndo_gso_check          = qlcnic_gso_check,
 #endif
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = qlcnic_poll_controller,
diff --git a/drivers/net/ethernet/qualcomm/Kconfig b/drivers/net/ethernet/qualcomm/Kconfig
index f3a47147937d..9a49f42ac2ba 100644
--- a/drivers/net/ethernet/qualcomm/Kconfig
+++ b/drivers/net/ethernet/qualcomm/Kconfig
@@ -5,7 +5,6 @@
 config NET_VENDOR_QUALCOMM
         bool "Qualcomm devices"
         default y
-        depends on SPI_MASTER && OF_GPIO
         ---help---
           If you have a network (Ethernet) card belonging to this class, say Y
           and read the Ethernet-HOWTO, available from
@@ -20,7 +19,7 @@ if NET_VENDOR_QUALCOMM
 
 config QCA7000
         tristate "Qualcomm Atheros QCA7000 support"
-        depends on SPI_MASTER && OF_GPIO
+        depends on SPI_MASTER && OF
         ---help---
           This SPI protocol driver supports the Qualcomm Atheros QCA7000.
 
diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 002d4cdc319f..a77f05ce8325 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -180,7 +180,8 @@ static int efx_ef10_probe(struct efx_nic *efx)
                       EFX_MAX_CHANNELS,
                       resource_size(&efx->pci_dev->resource[EFX_MEM_BAR]) /
                       (EFX_VI_PAGE_SIZE * EFX_TXQ_TYPES));
-        BUG_ON(efx->max_channels == 0);
+        if (WARN_ON(efx->max_channels == 0))
+                return -EIO;
 
         nic_data = kzalloc(sizeof(*nic_data), GFP_KERNEL);
         if (!nic_data)
diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
index ee84a90e371c..aaf2987512b5 100644
--- a/drivers/net/ethernet/sfc/tx.c
+++ b/drivers/net/ethernet/sfc/tx.c
@@ -343,8 +343,6 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         unsigned short dma_flags;
         int i = 0;
 
-        EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count);
-
         if (skb_shinfo(skb)->gso_size)
                 return efx_enqueue_skb_tso(tx_queue, skb);
 
@@ -1258,8 +1256,6 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
         /* Find the packet protocol and sanity-check it */
         state.protocol = efx_tso_check_protocol(skb);
 
-        EFX_BUG_ON_PARANOID(tx_queue->write_count > tx_queue->insert_count);
-
         rc = tso_start(&state, efx, skb);
         if (rc)
                 goto mem_err;
diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
index 5e94d00b96b3..6cc3cf6f17c8 100644
--- a/drivers/net/ethernet/smsc/smc91x.c
+++ b/drivers/net/ethernet/smsc/smc91x.c
@@ -81,6 +81,7 @@ static const char version[] =
 #include <linux/workqueue.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/of_gpio.h>
 
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -2188,6 +2189,41 @@ static const struct of_device_id smc91x_match[] = {
         {},
 };
 MODULE_DEVICE_TABLE(of, smc91x_match);
+
+/**
+ * of_try_set_control_gpio - configure a gpio if it exists
+ */
+static int try_toggle_control_gpio(struct device *dev,
+                                   struct gpio_desc **desc,
+                                   const char *name, int index,
+                                   int value, unsigned int nsdelay)
+{
+        struct gpio_desc *gpio = *desc;
+        int res;
+
+        gpio = devm_gpiod_get_index(dev, name, index);
+        if (IS_ERR(gpio)) {
+                if (PTR_ERR(gpio) == -ENOENT) {
+                        *desc = NULL;
+                        return 0;
+                }
+
+                return PTR_ERR(gpio);
+        }
+        res = gpiod_direction_output(gpio, !value);
+        if (res) {
+                dev_err(dev, "unable to toggle gpio %s: %i\n", name, res);
+                devm_gpiod_put(dev, gpio);
+                gpio = NULL;
+                return res;
+        }
+        if (nsdelay)
+                usleep_range(nsdelay, 2 * nsdelay);
+        gpiod_set_value_cansleep(gpio, value);
+        *desc = gpio;
+
+        return 0;
+}
 #endif
 
 /*
@@ -2207,9 +2243,10 @@ static int smc_drv_probe(struct platform_device *pdev)
         const struct of_device_id *match = NULL;
         struct smc_local *lp;
         struct net_device *ndev;
-        struct resource *res, *ires;
+        struct resource *res;
         unsigned int __iomem *addr;
         unsigned long irq_flags = SMC_IRQ_FLAGS;
+        unsigned long irq_resflags;
         int ret;
 
         ndev = alloc_etherdev(sizeof(struct smc_local));
@@ -2237,6 +2274,28 @@ static int smc_drv_probe(struct platform_device *pdev)
                 struct device_node *np = pdev->dev.of_node;
                 u32 val;
 
+                /* Optional pwrdwn GPIO configured? */
+                ret = try_toggle_control_gpio(&pdev->dev, &lp->power_gpio,
+                                              "power", 0, 0, 100);
+                if (ret)
+                        return ret;
+
+                /*
+                 * Optional reset GPIO configured? Minimum 100 ns reset needed
+                 * according to LAN91C96 datasheet page 14.
+                 */
+                ret = try_toggle_control_gpio(&pdev->dev, &lp->reset_gpio,
+                                              "reset", 0, 0, 100);
+                if (ret)
+                        return ret;
+
+                /*
+                 * Need to wait for optional EEPROM to load, max 750 us according
+                 * to LAN91C96 datasheet page 55.
+                 */
+                if (lp->reset_gpio)
+                        usleep_range(750, 1000);
+
                 /* Combination of IO widths supported, default to 16-bit */
                 if (!of_property_read_u32(np, "reg-io-width", &val)) {
                         if (val & 1)
@@ -2279,16 +2338,19 @@ static int smc_drv_probe(struct platform_device *pdev)
                 goto out_free_netdev;
         }
 
-        ires = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
-        if (!ires) {
+        ndev->irq = platform_get_irq(pdev, 0);
+        if (ndev->irq <= 0) {
                 ret = -ENODEV;
                 goto out_release_io;
         }
-
-        ndev->irq = ires->start;
-
-        if (irq_flags == -1 || ires->flags & IRQF_TRIGGER_MASK)
-                irq_flags = ires->flags & IRQF_TRIGGER_MASK;
+        /*
+         * If this platform does not specify any special irqflags, or if
+         * the resource supplies a trigger, override the irqflags with
+         * the trigger flags from the resource.
+         */
+        irq_resflags = irqd_get_trigger_type(irq_get_irq_data(ndev->irq));
+        if (irq_flags == -1 || irq_resflags & IRQF_TRIGGER_MASK)
+                irq_flags = irq_resflags & IRQF_TRIGGER_MASK;
 
         ret = smc_request_attrib(pdev, ndev);
         if (ret)
diff --git a/drivers/net/ethernet/smsc/smc91x.h b/drivers/net/ethernet/smsc/smc91x.h
index 47dce918eb0f..2a38dacbbd27 100644
--- a/drivers/net/ethernet/smsc/smc91x.h
+++ b/drivers/net/ethernet/smsc/smc91x.h
@@ -298,6 +298,9 @@ struct smc_local {
         struct sk_buff *pending_tx_skb;
         struct tasklet_struct tx_task;
 
+        struct gpio_desc *power_gpio;
+        struct gpio_desc *reset_gpio;
+
         /* version/revision of the SMC91x chip */
         int     version;
 
diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
index affb29da353e..77ed74561e5f 100644
--- a/drivers/net/ethernet/smsc/smsc911x.c
+++ b/drivers/net/ethernet/smsc/smsc911x.c
@@ -1342,6 +1342,42 @@ static void smsc911x_rx_multicast_update_workaround(struct smsc911x_data *pdata)
         spin_unlock(&pdata->mac_lock);
 }
 
+static int smsc911x_phy_general_power_up(struct smsc911x_data *pdata)
+{
+        int rc = 0;
+
+        if (!pdata->phy_dev)
+                return rc;
+
+        /* If the internal PHY is in General Power-Down mode, all, except the
+         * management interface, is powered-down and stays in that condition as
+         * long as Phy register bit 0.11 is HIGH.
+         *
+         * In that case, clear the bit 0.11, so the PHY powers up and we can
+         * access to the phy registers.
+         */
+        rc = phy_read(pdata->phy_dev, MII_BMCR);
+        if (rc < 0) {
+                SMSC_WARN(pdata, drv, "Failed reading PHY control reg");
+                return rc;
+        }
+
+        /* If the PHY general power-down bit is not set is not necessary to
+         * disable the general power down-mode.
+         */
+        if (rc & BMCR_PDOWN) {
+                rc = phy_write(pdata->phy_dev, MII_BMCR, rc & ~BMCR_PDOWN);
+                if (rc < 0) {
+                        SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
+                        return rc;
+                }
+
+                usleep_range(1000, 1500);
+        }
+
+        return 0;
+}
+
 static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
 {
         int rc = 0;
@@ -1356,12 +1392,8 @@ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
                 return rc;
         }
 
-        /*
-         * If energy is detected the PHY is already awake so is not necessary
-         * to disable the energy detect power-down mode.
-         */
-        if ((rc & MII_LAN83C185_EDPWRDOWN) &&
-            !(rc & MII_LAN83C185_ENERGYON)) {
+        /* Only disable if energy detect mode is already enabled */
+        if (rc & MII_LAN83C185_EDPWRDOWN) {
                 /* Disable energy detect mode for this SMSC Transceivers */
                 rc = phy_write(pdata->phy_dev, MII_LAN83C185_CTRL_STATUS,
                                rc & (~MII_LAN83C185_EDPWRDOWN));
@@ -1370,8 +1402,8 @@ static int smsc911x_phy_disable_energy_detect(struct smsc911x_data *pdata)
                         SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
                         return rc;
                 }
-
-                mdelay(1);
+                /* Allow PHY to wakeup */
+                mdelay(2);
         }
 
         return 0;
@@ -1393,7 +1425,6 @@ static int smsc911x_phy_enable_energy_detect(struct smsc911x_data *pdata)
 
         /* Only enable if energy detect mode is already disabled */
         if (!(rc & MII_LAN83C185_EDPWRDOWN)) {
-                mdelay(100);
                 /* Enable energy detect mode for this SMSC Transceivers */
                 rc = phy_write(pdata->phy_dev, MII_LAN83C185_CTRL_STATUS,
                                rc | MII_LAN83C185_EDPWRDOWN);
@@ -1402,8 +1433,6 @@ static int smsc911x_phy_enable_energy_detect(struct smsc911x_data *pdata)
                         SMSC_WARN(pdata, drv, "Failed writing PHY control reg");
                         return rc;
                 }
-
-                mdelay(1);
         }
         return 0;
 }
@@ -1415,6 +1444,16 @@ static int smsc911x_soft_reset(struct smsc911x_data *pdata)
         int ret;
 
         /*
+         * Make sure to power-up the PHY chip before doing a reset, otherwise
+         * the reset fails.
+         */
+        ret = smsc911x_phy_general_power_up(pdata);
+        if (ret) {
+                SMSC_WARN(pdata, drv, "Failed to power-up the PHY chip");
+                return ret;
+        }
+
+        /*
          * LAN9210/LAN9211/LAN9220/LAN9221 chips have an internal PHY that
          * are initialized in a Energy Detect Power-Down mode that prevents
          * the MAC chip to be software reseted. So we have to wakeup the PHY
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 6f77a46c7e2c..18c46bb0f3bf 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -276,6 +276,7 @@ static void stmmac_eee_ctrl_timer(unsigned long arg)
 bool stmmac_eee_init(struct stmmac_priv *priv)
 {
         char *phy_bus_name = priv->plat->phy_bus_name;
+        unsigned long flags;
         bool ret = false;
 
         /* Using PCS we cannot dial with the phy registers at this stage
@@ -300,6 +301,7 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                          * changed).
                          * In that case the driver disable own timers.
                          */
+                        spin_lock_irqsave(&priv->lock, flags);
                         if (priv->eee_active) {
                                 pr_debug("stmmac: disable EEE\n");
                                 del_timer_sync(&priv->eee_ctrl_timer);
@@ -307,9 +309,11 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                                                              tx_lpi_timer);
                         }
                         priv->eee_active = 0;
+                        spin_unlock_irqrestore(&priv->lock, flags);
                         goto out;
                 }
                 /* Activate the EEE and start timers */
+                spin_lock_irqsave(&priv->lock, flags);
                 if (!priv->eee_active) {
                         priv->eee_active = 1;
                         init_timer(&priv->eee_ctrl_timer);
@@ -325,9 +329,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv)
                 /* Set HW EEE according to the speed */
                 priv->hw->mac->set_eee_pls(priv->hw, priv->phydev->link);
 
-                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
-
                 ret = true;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                pr_debug("stmmac: Energy-Efficient Ethernet initialized\n");
         }
 out:
         return ret;
@@ -760,12 +765,12 @@ static void stmmac_adjust_link(struct net_device *dev)
         if (new_state && netif_msg_link(priv))
                 phy_print_status(phydev);
 
+        spin_unlock_irqrestore(&priv->lock, flags);
+
         /* At this stage, it could be needed to setup the EEE or adjust some
          * MAC related HW registers.
          */
         priv->eee_enabled = stmmac_eee_init(priv);
-
-        spin_unlock_irqrestore(&priv->lock, flags);
 }
 
 /**
@@ -959,12 +964,12 @@ static void stmmac_clear_descriptors(struct stmmac_priv *priv)
 }
 
 static int stmmac_init_rx_buffers(struct stmmac_priv *priv, struct dma_desc *p,
-                                  int i)
+                                  int i, gfp_t flags)
 {
         struct sk_buff *skb;
 
         skb = __netdev_alloc_skb(priv->dev, priv->dma_buf_sz + NET_IP_ALIGN,
-                                 GFP_KERNEL);
+                                 flags);
         if (!skb) {
                 pr_err("%s: Rx init fails; skb is NULL\n", __func__);
                 return -ENOMEM;
@@ -1006,7 +1011,7 @@ static void stmmac_free_rx_buffers(struct stmmac_priv *priv, int i)
  * and allocates the socket buffers. It suppors the chained and ring
  * modes.
  */
-static int init_dma_desc_rings(struct net_device *dev)
+static int init_dma_desc_rings(struct net_device *dev, gfp_t flags)
 {
         int i;
         struct stmmac_priv *priv = netdev_priv(dev);
@@ -1041,7 +1046,7 @@ static int init_dma_desc_rings(struct net_device *dev)
                 else
                         p = priv->dma_rx + i;
 
-                ret = stmmac_init_rx_buffers(priv, p, i);
+                ret = stmmac_init_rx_buffers(priv, p, i, flags);
                 if (ret)
                         goto err_init_rx_buffers;
 
@@ -1647,11 +1652,6 @@ static int stmmac_hw_setup(struct net_device *dev)
         struct stmmac_priv *priv = netdev_priv(dev);
         int ret;
 
-        ret = init_dma_desc_rings(dev);
-        if (ret < 0) {
-                pr_err("%s: DMA descriptors initialization failed\n", __func__);
-                return ret;
-        }
         /* DMA initialization and SW reset */
         ret = stmmac_init_dma_engine(priv);
         if (ret < 0) {
@@ -1705,10 +1705,6 @@ static int stmmac_hw_setup(struct net_device *dev)
         }
         priv->tx_lpi_timer = STMMAC_DEFAULT_TWT_LS;
 
-        priv->eee_enabled = stmmac_eee_init(priv);
-
-        stmmac_init_tx_coalesce(priv);
-
         if ((priv->use_riwt) && (priv->hw->dma->rx_watchdog)) {
                 priv->rx_riwt = MAX_DMA_RIWT;
                 priv->hw->dma->rx_watchdog(priv->ioaddr, MAX_DMA_RIWT);
@@ -1761,12 +1757,20 @@ static int stmmac_open(struct net_device *dev)
                 goto dma_desc_error;
         }
 
+        ret = init_dma_desc_rings(dev, GFP_KERNEL);
+        if (ret < 0) {
+                pr_err("%s: DMA descriptors initialization failed\n", __func__);
+                goto init_error;
+        }
+
         ret = stmmac_hw_setup(dev);
         if (ret < 0) {
                 pr_err("%s: Hw setup failed\n", __func__);
                 goto init_error;
         }
 
+        stmmac_init_tx_coalesce(priv);
+
         if (priv->phydev)
                 phy_start(priv->phydev);
 
@@ -1894,7 +1898,10 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned int nopaged_len = skb_headlen(skb);
         unsigned int enh_desc = priv->plat->enh_desc;
 
+        spin_lock(&priv->tx_lock);
+
         if (unlikely(stmmac_tx_avail(priv) < nfrags + 1)) {
+                spin_unlock(&priv->tx_lock);
                 if (!netif_queue_stopped(dev)) {
                         netif_stop_queue(dev);
                         /* This is a hard error, log it. */
@@ -1903,8 +1910,6 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                 return NETDEV_TX_BUSY;
         }
 
-        spin_lock(&priv->tx_lock);
-
         if (priv->tx_path_in_lpi_mode)
                 stmmac_disable_eee_mode(priv);
 
@@ -2025,6 +2030,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
         return NETDEV_TX_OK;
 
 dma_map_err:
+        spin_unlock(&priv->tx_lock);
         dev_err(priv->device, "Tx dma map failed\n");
         dev_kfree_skb(skb);
         priv->dev->stats.tx_dropped++;
@@ -2281,9 +2287,7 @@ static void stmmac_set_rx_mode(struct net_device *dev)
 {
         struct stmmac_priv *priv = netdev_priv(dev);
 
-        spin_lock(&priv->lock);
         priv->hw->mac->set_filter(priv->hw, dev);
-        spin_unlock(&priv->lock);
 }
 
 /**
@@ -2950,7 +2954,7 @@ int stmmac_suspend(struct net_device *ndev)
                 stmmac_set_mac(priv->ioaddr, false);
                 pinctrl_pm_select_sleep_state(priv->device);
                 /* Disable clock in case of PWM is off */
-                clk_disable_unprepare(priv->stmmac_clk);
+                clk_disable(priv->stmmac_clk);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2982,7 +2986,7 @@ int stmmac_resume(struct net_device *ndev)
         } else {
                 pinctrl_pm_select_default_state(priv->device);
                 /* enable the clk prevously disabled */
-                clk_prepare_enable(priv->stmmac_clk);
+                clk_enable(priv->stmmac_clk);
                 /* reset the phy so that it's ready */
                 if (priv->mii)
                         stmmac_mdio_reset(priv->mii);
@@ -2990,7 +2994,9 @@ int stmmac_resume(struct net_device *ndev)
 
         netif_device_attach(ndev);
 
+        init_dma_desc_rings(ndev, GFP_ATOMIC);
         stmmac_hw_setup(ndev);
+        stmmac_init_tx_coalesce(priv);
 
         napi_enable(&priv->napi);
 
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
index 655a23bbc451..e17a970eaf2b 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
@@ -33,6 +33,7 @@ static struct stmmac_dma_cfg dma_cfg;
 static void stmmac_default_data(void)
 {
         memset(&plat_dat, 0, sizeof(struct plat_stmmacenet_data));
+
         plat_dat.bus_id = 1;
         plat_dat.phy_addr = 0;
         plat_dat.interface = PHY_INTERFACE_MODE_GMII;
@@ -47,6 +48,12 @@ static void stmmac_default_data(void)
         dma_cfg.pbl = 32;
         dma_cfg.burst_len = DMA_AXI_BLEN_256;
         plat_dat.dma_cfg = &dma_cfg;
+
+        /* Set default value for multicast hash bins */
+        plat_dat.multicast_filter_bins = HASH_TABLE_SIZE;
+
+        /* Set default value for unicast filter entries */
+        plat_dat.unicast_filter_entries = 1;
 }
 
 /**
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index 72c8525d5457..9c014803b03b 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1262,6 +1262,7 @@ static void happy_meal_init_rings(struct happy_meal *hp)
         HMD(("init rxring, "));
         for (i = 0; i < RX_RING_SIZE; i++) {
                 struct sk_buff *skb;
+                u32 mapping;
 
                 skb = happy_meal_alloc_skb(RX_BUF_ALLOC_SIZE, GFP_ATOMIC);
                 if (!skb) {
@@ -1272,10 +1273,16 @@ static void happy_meal_init_rings(struct happy_meal *hp)
 
                 /* Because we reserve afterwards. */
                 skb_put(skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
+                mapping = dma_map_single(hp->dma_dev, skb->data, RX_BUF_ALLOC_SIZE,
+                                         DMA_FROM_DEVICE);
+                if (dma_mapping_error(hp->dma_dev, mapping)) {
+                        dev_kfree_skb_any(skb);
+                        hme_write_rxd(hp, &hb->happy_meal_rxd[i], 0, 0);
+                        continue;
+                }
                 hme_write_rxd(hp, &hb->happy_meal_rxd[i],
                               (RXFLAG_OWN | ((RX_BUF_ALLOC_SIZE - RX_OFFSET) << 16)),
-                              dma_map_single(hp->dma_dev, skb->data, RX_BUF_ALLOC_SIZE,
-                                             DMA_FROM_DEVICE));
+                              mapping);
                 skb_reserve(skb, RX_OFFSET);
         }
 
@@ -2020,6 +2027,7 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                 skb = hp->rx_skbs[elem];
                 if (len > RX_COPY_THRESHOLD) {
                         struct sk_buff *new_skb;
+                        u32 mapping;
 
                         /* Now refill the entry, if we can. */
                         new_skb = happy_meal_alloc_skb(RX_BUF_ALLOC_SIZE, GFP_ATOMIC);
@@ -2027,13 +2035,21 @@ static void happy_meal_rx(struct happy_meal *hp, struct net_device *dev)
                                 drops++;
                                 goto drop_it;
                         }
+                        skb_put(new_skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
+                        mapping = dma_map_single(hp->dma_dev, new_skb->data,
+                                                 RX_BUF_ALLOC_SIZE,
+                                                 DMA_FROM_DEVICE);
+                        if (unlikely(dma_mapping_error(hp->dma_dev, mapping))) {
+                                dev_kfree_skb_any(new_skb);
+                                drops++;
+                                goto drop_it;
+                        }
+
                         dma_unmap_single(hp->dma_dev, dma_addr, RX_BUF_ALLOC_SIZE, DMA_FROM_DEVICE);
                         hp->rx_skbs[elem] = new_skb;
-                        skb_put(new_skb, (ETH_FRAME_LEN + RX_OFFSET + 4));
                         hme_write_rxd(hp, this,
                                       (RXFLAG_OWN|((RX_BUF_ALLOC_SIZE-RX_OFFSET)<<16)),
-                                      dma_map_single(hp->dma_dev, new_skb->data, RX_BUF_ALLOC_SIZE,
-                                                     DMA_FROM_DEVICE));
+                                      mapping);
                         skb_reserve(new_skb, RX_OFFSET);
 
                         /* Trim the original skb for the netif. */
@@ -2248,6 +2264,25 @@ static void happy_meal_tx_timeout(struct net_device *dev)
         netif_wake_queue(dev);
 }
 
+static void unmap_partial_tx_skb(struct happy_meal *hp, u32 first_mapping,
+                                 u32 first_len, u32 first_entry, u32 entry)
+{
+        struct happy_meal_txd *txbase = &hp->happy_block->happy_meal_txd[0];
+
+        dma_unmap_single(hp->dma_dev, first_mapping, first_len, DMA_TO_DEVICE);
+
+        first_entry = NEXT_TX(first_entry);
+        while (first_entry != entry) {
+                struct happy_meal_txd *this = &txbase[first_entry];
+                u32 addr, len;
+
+                addr = hme_read_desc32(hp, &this->tx_addr);
+                len = hme_read_desc32(hp, &this->tx_flags);
+                len &= TXFLAG_SIZE;
+                dma_unmap_page(hp->dma_dev, addr, len, DMA_TO_DEVICE);
+        }
+}
+
 static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                                          struct net_device *dev)
 {
@@ -2284,6 +2319,8 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
 
                 len = skb->len;
                 mapping = dma_map_single(hp->dma_dev, skb->data, len, DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(hp->dma_dev, mapping)))
+                        goto out_dma_error;
                 tx_flags |= (TXFLAG_SOP | TXFLAG_EOP);
                 hme_write_txd(hp, &hp->happy_block->happy_meal_txd[entry],
                               (tx_flags | (len & TXFLAG_SIZE)),
@@ -2299,6 +2336,8 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                 first_len = skb_headlen(skb);
                 first_mapping = dma_map_single(hp->dma_dev, skb->data, first_len,
                                                DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(hp->dma_dev, first_mapping)))
+                        goto out_dma_error;
                 entry = NEXT_TX(entry);
 
                 for (frag = 0; frag < skb_shinfo(skb)->nr_frags; frag++) {
@@ -2308,6 +2347,11 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
                         len = skb_frag_size(this_frag);
                         mapping = skb_frag_dma_map(hp->dma_dev, this_frag,
                                                    0, len, DMA_TO_DEVICE);
+                        if (unlikely(dma_mapping_error(hp->dma_dev, mapping))) {
+                                unmap_partial_tx_skb(hp, first_mapping, first_len,
+                                                     first_entry, entry);
+                                goto out_dma_error;
+                        }
                         this_txflags = tx_flags;
                         if (frag == skb_shinfo(skb)->nr_frags - 1)
                                 this_txflags |= TXFLAG_EOP;
@@ -2333,6 +2377,14 @@ static netdev_tx_t happy_meal_start_xmit(struct sk_buff *skb,
 
         tx_add_log(hp, TXLOG_ACTION_TXMIT, 0);
         return NETDEV_TX_OK;
+
+out_dma_error:
+        hp->tx_skbs[hp->tx_new] = NULL;
+        spin_unlock_irq(&hp->happy_lock);
+
+        dev_kfree_skb_any(skb);
+        dev->stats.tx_dropped++;
+        return NETDEV_TX_OK;
 }
 
 static struct net_device_stats *happy_meal_get_stats(struct net_device *dev)
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 952e1e4764b7..c560f9aeb55d 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -129,9 +129,9 @@ do {								\
 #define CPSW_VLAN_AWARE         BIT(1)
 #define CPSW_ALE_VLAN_AWARE     1
 
-#define CPSW_FIFO_NORMAL_MODE           (0 << 15)
-#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 15)
-#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 15)
+#define CPSW_FIFO_NORMAL_MODE           (0 << 16)
+#define CPSW_FIFO_DUAL_MAC_MODE         (1 << 16)
+#define CPSW_FIFO_RATE_LIMIT_MODE       (2 << 16)
 
 #define CPSW_INTPACEEN          (0x3f << 16)
 #define CPSW_INTPRESCALE_MASK   (0x7FF << 0)
@@ -591,8 +591,8 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                 if (enable) {
                         unsigned long timeout = jiffies + HZ;
 
-                        /* Disable Learn for all ports */
-                        for (i = 0; i < priv->data.slaves; i++) {
+                        /* Disable Learn for all ports (host is port 0 and slaves are port 1 and up */
+                        for (i = 0; i <= priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 1);
                                 cpsw_ale_control_set(ale, i,
@@ -616,11 +616,11 @@ static void cpsw_set_promiscious(struct net_device *ndev, bool enable)
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 1);
                         dev_dbg(&ndev->dev, "promiscuity enabled\n");
                 } else {
-                        /* Flood All Unicast Packets to Host port */
+                        /* Don't Flood All Unicast Packets to Host port */
                         cpsw_ale_control_set(ale, 0, ALE_P0_UNI_FLOOD, 0);
 
-                        /* Enable Learn for all ports */
-                        for (i = 0; i < priv->data.slaves; i++) {
+                        /* Enable Learn for all ports (host is port 0 and slaves are port 1 and up */
+                        for (i = 0; i <= priv->data.slaves; i++) {
                                 cpsw_ale_control_set(ale, i,
                                                      ALE_PORT_NOLEARN, 0);
                                 cpsw_ale_control_set(ale, i,
@@ -638,12 +638,16 @@ static void cpsw_ndo_set_rx_mode(struct net_device *ndev)
         if (ndev->flags & IFF_PROMISC) {
                 /* Enable promiscuous mode */
                 cpsw_set_promiscious(ndev, true);
+                cpsw_ale_set_allmulti(priv->ale, IFF_ALLMULTI);
                 return;
         } else {
                 /* Disable promiscuous mode */
                 cpsw_set_promiscious(ndev, false);
         }
 
+        /* Restore allmulti on vlans if necessary */
+        cpsw_ale_set_allmulti(priv->ale, priv->ndev->flags & IFF_ALLMULTI);
+
         /* Clear all mcast from ALE */
         cpsw_ale_flush_multicast(priv->ale, ALE_ALL_PORTS << priv->host_port);
 
@@ -1149,6 +1153,7 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
         const int port = priv->host_port;
         u32 reg;
         int i;
+        int unreg_mcast_mask;
 
         reg = (priv->version == CPSW_VERSION_1) ? CPSW1_PORT_VLAN :
                CPSW2_PORT_VLAN;
@@ -1158,9 +1163,14 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
         for (i = 0; i < priv->data.slaves; i++)
                 slave_write(priv->slaves + i, vlan, reg);
 
+        if (priv->ndev->flags & IFF_ALLMULTI)
+                unreg_mcast_mask = ALE_ALL_PORTS;
+        else
+                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
+
         cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port,
                           ALE_ALL_PORTS << port, ALE_ALL_PORTS << port,
-                          (ALE_PORT_1 | ALE_PORT_2) << port);
+                          unreg_mcast_mask << port);
 }
 
 static void cpsw_init_host_port(struct cpsw_priv *priv)
@@ -1620,11 +1630,17 @@ static inline int cpsw_add_vlan_ale_entry(struct cpsw_priv *priv,
                                 unsigned short vid)
 {
         int ret;
+        int unreg_mcast_mask;
+
+        if (priv->ndev->flags & IFF_ALLMULTI)
+                unreg_mcast_mask = ALE_ALL_PORTS;
+        else
+                unreg_mcast_mask = ALE_PORT_1 | ALE_PORT_2;
 
         ret = cpsw_ale_add_vlan(priv->ale, vid,
                                 ALE_ALL_PORTS << priv->host_port,
                                 0, ALE_ALL_PORTS << priv->host_port,
-                                (ALE_PORT_1 | ALE_PORT_2) << priv->host_port);
+                                unreg_mcast_mask << priv->host_port);
         if (ret != 0)
                 return ret;
 
@@ -2006,7 +2022,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 parp = of_get_property(slave_node, "phy_id", &lenp);
                 if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
                         dev_err(&pdev->dev, "Missing slave[%d] phy_id property\n", i);
-                        return -EINVAL;
+                        goto no_phy_slave;
                 }
                 mdio_node = of_find_node_by_phandle(be32_to_cpup(parp));
                 phyid = be32_to_cpup(parp+1);
@@ -2019,6 +2035,14 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                 snprintf(slave_data->phy_id, sizeof(slave_data->phy_id),
                          PHY_ID_FMT, mdio->name, phyid);
 
+                slave_data->phy_if = of_get_phy_mode(slave_node);
+                if (slave_data->phy_if < 0) {
+                        dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
+                                i);
+                        return slave_data->phy_if;
+                }
+
+no_phy_slave:
                 mac_addr = of_get_mac_address(slave_node);
                 if (mac_addr) {
                         memcpy(slave_data->mac_addr, mac_addr, ETH_ALEN);
@@ -2030,14 +2054,6 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
                                         return ret;
                         }
                 }
-
-                slave_data->phy_if = of_get_phy_mode(slave_node);
-                if (slave_data->phy_if < 0) {
-                        dev_err(&pdev->dev, "Missing or malformed slave[%d] phy-mode property\n",
-                                i);
-                        return slave_data->phy_if;
-                }
-
                 if (data->dual_emac) {
                         if (of_property_read_u32(slave_node, "dual_emac_res_vlan",
                                                  &prop)) {
diff --git a/drivers/net/ethernet/ti/cpsw_ale.c b/drivers/net/ethernet/ti/cpsw_ale.c
index 0579b2243bb6..097ebe7077ac 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.c
+++ b/drivers/net/ethernet/ti/cpsw_ale.c
@@ -443,6 +443,35 @@ int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port_mask)
         return 0;
 }
 
+void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti)
+{
+        u32 ale_entry[ALE_ENTRY_WORDS];
+        int type, idx;
+        int unreg_mcast = 0;
+
+        /* Only bother doing the work if the setting is actually changing */
+        if (ale->allmulti == allmulti)
+                return;
+
+        /* Remember the new setting to check against next time */
+        ale->allmulti = allmulti;
+
+        for (idx = 0; idx < ale->params.ale_entries; idx++) {
+                cpsw_ale_read(ale, idx, ale_entry);
+                type = cpsw_ale_get_entry_type(ale_entry);
+                if (type != ALE_TYPE_VLAN)
+                        continue;
+
+                unreg_mcast = cpsw_ale_get_vlan_unreg_mcast(ale_entry);
+                if (allmulti)
+                        unreg_mcast |= 1;
+                else
+                        unreg_mcast &= ~1;
+                cpsw_ale_set_vlan_unreg_mcast(ale_entry, unreg_mcast);
+                cpsw_ale_write(ale, idx, ale_entry);
+        }
+}
+
 struct ale_control_info {
         const char      *name;
         int             offset, port_offset;
@@ -756,7 +785,6 @@ int cpsw_ale_destroy(struct cpsw_ale *ale)
 {
         if (!ale)
                 return -EINVAL;
-        cpsw_ale_stop(ale);
         cpsw_ale_control_set(ale, 0, ALE_ENABLE, 0);
         kfree(ale);
         return 0;
diff --git a/drivers/net/ethernet/ti/cpsw_ale.h b/drivers/net/ethernet/ti/cpsw_ale.h
index 31cf43cab42e..c0d4127aa549 100644
--- a/drivers/net/ethernet/ti/cpsw_ale.h
+++ b/drivers/net/ethernet/ti/cpsw_ale.h
@@ -27,6 +27,7 @@ struct cpsw_ale {
         struct cpsw_ale_params  params;
         struct timer_list       timer;
         unsigned long           ageout;
+        int                     allmulti;
 };
 
 enum cpsw_ale_control {
@@ -103,6 +104,7 @@ int cpsw_ale_del_mcast(struct cpsw_ale *ale, u8 *addr, int port_mask,
 int cpsw_ale_add_vlan(struct cpsw_ale *ale, u16 vid, int port, int untag,
                         int reg_mcast, int unreg_mcast);
 int cpsw_ale_del_vlan(struct cpsw_ale *ale, u16 vid, int port);
+void cpsw_ale_set_allmulti(struct cpsw_ale *ale, int allmulti);
 
 int cpsw_ale_control_get(struct cpsw_ale *ale, int port, int control);
 int cpsw_ale_control_set(struct cpsw_ale *ale, int port,
diff --git a/drivers/net/ethernet/ti/cpts.c b/drivers/net/ethernet/ti/cpts.c
index ab92f67da035..4a4388b813ac 100644
--- a/drivers/net/ethernet/ti/cpts.c
+++ b/drivers/net/ethernet/ti/cpts.c
@@ -264,7 +264,7 @@ static int cpts_match(struct sk_buff *skb, unsigned int ptp_class,
 
         switch (ptp_class & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 9e17d1a91e71..78ec33f5100b 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -550,6 +550,7 @@ do_lso:
 do_send:
         /* Start filling in the page buffers with the rndis hdr */
         rndis_msg->msg_len += rndis_msg_size;
+        packet->total_data_buflen = rndis_msg->msg_len;
         packet->page_buf_cnt = init_page_array(rndis_msg, rndis_msg_size,
                                         skb, &packet->page_buf[0]);
 
diff --git a/drivers/net/ieee802154/fakehard.c b/drivers/net/ieee802154/fakehard.c
index 9ce854f43917..6cbc56ad9ff4 100644
--- a/drivers/net/ieee802154/fakehard.c
+++ b/drivers/net/ieee802154/fakehard.c
@@ -377,17 +377,20 @@ static int ieee802154fake_probe(struct platform_device *pdev)
 
         err = wpan_phy_register(phy);
         if (err)
-                goto out;
+                goto err_phy_reg;
 
         err = register_netdev(dev);
-        if (err < 0)
-                goto out;
+        if (err)
+                goto err_netdev_reg;
 
         dev_info(&pdev->dev, "Added ieee802154 HardMAC hardware\n");
         return 0;
 
-out:
-        unregister_netdev(dev);
+err_netdev_reg:
+        wpan_phy_unregister(phy);
+err_phy_reg:
+        free_netdev(dev);
+        wpan_phy_free(phy);
         return err;
 }
 
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 29b3bb410781..bfb0b6ec8c56 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -272,7 +272,7 @@ static void macvlan_process_broadcast(struct work_struct *w)
         struct sk_buff *skb;
         struct sk_buff_head list;
 
-        skb_queue_head_init(&list);
+        __skb_queue_head_init(&list);
 
         spin_lock_bh(&port->bc_queue.lock);
         skb_queue_splice_tail_init(&port->bc_queue, &list);
@@ -1082,9 +1082,15 @@ static void macvlan_port_destroy(struct net_device *dev)
 {
         struct macvlan_port *port = macvlan_port_get_rtnl(dev);
 
-        cancel_work_sync(&port->bc_work);
         dev->priv_flags &= ~IFF_MACVLAN_PORT;
         netdev_rx_handler_unregister(dev);
+
+        /* After this point, no packet can schedule bc_work anymore,
+         * but we need to cancel it and purge left skbs if any.
+         */
+        cancel_work_sync(&port->bc_work);
+        __skb_queue_purge(&port->bc_queue);
+
         kfree_rcu(port, rcu);
 }
 
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 65e2892342bd..880cc090dc44 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -16,6 +16,7 @@
 #include <linux/idr.h>
 #include <linux/fs.h>
 
+#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/rtnetlink.h>
 #include <net/sock.h>
@@ -65,7 +66,7 @@ static struct cdev macvtap_cdev;
 static const struct proto_ops macvtap_socket_ops;
 
 #define TUN_OFFLOADS (NETIF_F_HW_CSUM | NETIF_F_TSO_ECN | NETIF_F_TSO | \
-                      NETIF_F_TSO6 | NETIF_F_UFO)
+                      NETIF_F_TSO6)
 #define RX_OFFLOADS (NETIF_F_GRO | NETIF_F_LRO)
 #define TAP_FEATURES (NETIF_F_GSO | NETIF_F_SG)
 
@@ -569,7 +570,11 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb,
                         gso_type = SKB_GSO_TCPV6;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                        pr_warn_once("macvtap: %s: using disabled UFO feature; please fix this program\n",
+                                     current->comm);
                         gso_type = SKB_GSO_UDP;
+                        if (skb->protocol == htons(ETH_P_IPV6))
+                                ipv6_proxy_select_ident(skb);
                         break;
                 default:
                         return -EINVAL;
@@ -614,8 +619,6 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                 else if (sinfo->gso_type & SKB_GSO_TCPV6)
                         vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                else if (sinfo->gso_type & SKB_GSO_UDP)
-                        vnet_hdr->gso_type = VIRTIO_NET_HDR_GSO_UDP;
                 else
                         BUG();
                 if (sinfo->gso_type & SKB_GSO_TCP_ECN)
@@ -626,6 +629,8 @@ static void macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 vnet_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
                 vnet_hdr->csum_start = skb_checksum_start_offset(skb);
+                if (vlan_tx_tag_present(skb))
+                        vnet_hdr->csum_start += VLAN_HLEN;
                 vnet_hdr->csum_offset = skb->csum_offset;
         } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                 vnet_hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
@@ -950,9 +955,6 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
                         if (arg & TUN_F_TSO6)
                                 feature_mask |= NETIF_F_TSO6;
                 }
-
-                if (arg & TUN_F_UFO)
-                        feature_mask |= NETIF_F_UFO;
         }
 
         /* tun/tap driver inverts the usage for TSO offloads, where
@@ -963,7 +965,7 @@ static int set_offload(struct macvtap_queue *q, unsigned long arg)
          * When user space turns off TSO, we turn off GSO/LRO so that
          * user-space will not receive TSO frames.
          */
-        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_UFO))
+        if (feature_mask & (NETIF_F_TSO | NETIF_F_TSO6))
                 features |= RX_OFFLOADS;
         else
                 features &= ~RX_OFFLOADS;
@@ -1064,7 +1066,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
         case TUNSETOFFLOAD:
                 /* let the user check for future flags */
                 if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
-                            TUN_F_TSO_ECN | TUN_F_UFO))
+                            TUN_F_TSO_ECN))
                         return -EINVAL;
 
                 rtnl_lock();
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index 2954052706e8..e22e602beef3 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -791,7 +791,7 @@ static int match(struct sk_buff *skb, unsigned int type, struct rxts *rxts)
 
         switch (type & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
@@ -934,7 +934,7 @@ static int is_sync(struct sk_buff *skb, int type)
 
         switch (type & PTP_CLASS_PMASK) {
         case PTP_CLASS_IPV4:
-                offset += ETH_HLEN + IPV4_HLEN(data) + UDP_HLEN;
+                offset += ETH_HLEN + IPV4_HLEN(data + offset) + UDP_HLEN;
                 break;
         case PTP_CLASS_IPV6:
                 offset += ETH_HLEN + IP6_HLEN + UDP_HLEN;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index bd37e45c89c0..225c033b08f3 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -50,10 +50,15 @@
 #define MII_M1011_PHY_SCR               0x10
 #define MII_M1011_PHY_SCR_AUTO_CROSS    0x0060
 
+#define MII_M1145_PHY_EXT_SR            0x1b
 #define MII_M1145_PHY_EXT_CR            0x14
 #define MII_M1145_RGMII_RX_DELAY        0x0080
 #define MII_M1145_RGMII_TX_DELAY        0x0002
 
+#define MII_M1145_HWCFG_MODE_SGMII_NO_CLK       0x4
+#define MII_M1145_HWCFG_MODE_MASK               0xf
+#define MII_M1145_HWCFG_FIBER_COPPER_AUTO       0x8000
+
 #define MII_M1111_PHY_LED_CONTROL       0x18
 #define MII_M1111_PHY_LED_DIRECT        0x4100
 #define MII_M1111_PHY_LED_COMBINE       0x411c
@@ -676,6 +681,20 @@ static int m88e1145_config_init(struct phy_device *phydev)
                 }
         }
 
+        if (phydev->interface == PHY_INTERFACE_MODE_SGMII) {
+                int temp = phy_read(phydev, MII_M1145_PHY_EXT_SR);
+                if (temp < 0)
+                        return temp;
+
+                temp &= ~MII_M1145_HWCFG_MODE_MASK;
+                temp |= MII_M1145_HWCFG_MODE_SGMII_NO_CLK;
+                temp |= MII_M1145_HWCFG_FIBER_COPPER_AUTO;
+
+                err = phy_write(phydev, MII_M1145_PHY_EXT_SR, temp);
+                if (err < 0)
+                        return err;
+        }
+
         err = marvell_of_reg_init(phydev);
         if (err < 0)
                 return err;
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 1dfffdc9dfc3..767cd110f496 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -352,6 +352,7 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
 {
         struct mii_ioctl_data *mii_data = if_mii(ifr);
         u16 val = mii_data->val_in;
+        bool change_autoneg = false;
 
         switch (cmd) {
         case SIOCGMIIPHY:
@@ -367,22 +368,29 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 if (mii_data->phy_id == phydev->addr) {
                         switch (mii_data->reg_num) {
                         case MII_BMCR:
-                                if ((val & (BMCR_RESET | BMCR_ANENABLE)) == 0)
+                                if ((val & (BMCR_RESET | BMCR_ANENABLE)) == 0) {
+                                        if (phydev->autoneg == AUTONEG_ENABLE)
+                                                change_autoneg = true;
                                         phydev->autoneg = AUTONEG_DISABLE;
-                                else
+                                        if (val & BMCR_FULLDPLX)
+                                                phydev->duplex = DUPLEX_FULL;
+                                        else
+                                                phydev->duplex = DUPLEX_HALF;
+                                        if (val & BMCR_SPEED1000)
+                                                phydev->speed = SPEED_1000;
+                                        else if (val & BMCR_SPEED100)
+                                                phydev->speed = SPEED_100;
+                                        else phydev->speed = SPEED_10;
+                                }
+                                else {
+                                        if (phydev->autoneg == AUTONEG_DISABLE)
+                                                change_autoneg = true;
                                         phydev->autoneg = AUTONEG_ENABLE;
-                                if (!phydev->autoneg && (val & BMCR_FULLDPLX))
-                                        phydev->duplex = DUPLEX_FULL;
-                                else
-                                        phydev->duplex = DUPLEX_HALF;
-                                if (!phydev->autoneg && (val & BMCR_SPEED1000))
-                                        phydev->speed = SPEED_1000;
-                                else if (!phydev->autoneg &&
-                                         (val & BMCR_SPEED100))
-                                        phydev->speed = SPEED_100;
+                                }
                                 break;
                         case MII_ADVERTISE:
-                                phydev->advertising = val;
+                                phydev->advertising = mii_adv_to_ethtool_adv_t(val);
+                                change_autoneg = true;
                                 break;
                         default:
                                 /* do nothing */
@@ -396,6 +404,10 @@ int phy_mii_ioctl(struct phy_device *phydev, struct ifreq *ifr, int cmd)
                 if (mii_data->reg_num == MII_BMCR &&
                     val & BMCR_RESET)
                         return phy_init_hw(phydev);
+
+                if (change_autoneg)
+                        return phy_start_aneg(phydev);
+
                 return 0;
 
         case SIOCSHWTSTAMP:
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index 68c3a3f4e0ab..794a47329368 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -755,23 +755,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 err = get_filter(argp, &code);
                 if (err >= 0) {
+                        struct bpf_prog *pass_filter = NULL;
                         struct sock_fprog_kern fprog = {
                                 .len = err,
                                 .filter = code,
                         };
 
-                        ppp_lock(ppp);
-                        if (ppp->pass_filter) {
-                                bpf_prog_destroy(ppp->pass_filter);
-                                ppp->pass_filter = NULL;
+                        err = 0;
+                        if (fprog.filter)
+                                err = bpf_prog_create(&pass_filter, &fprog);
+                        if (!err) {
+                                ppp_lock(ppp);
+                                if (ppp->pass_filter)
+                                        bpf_prog_destroy(ppp->pass_filter);
+                                ppp->pass_filter = pass_filter;
+                                ppp_unlock(ppp);
                         }
-                        if (fprog.filter != NULL)
-                                err = bpf_prog_create(&ppp->pass_filter,
-                                                      &fprog);
-                        else
-                                err = 0;
                         kfree(code);
-                        ppp_unlock(ppp);
                 }
                 break;
         }
@@ -781,23 +781,23 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 
                 err = get_filter(argp, &code);
                 if (err >= 0) {
+                        struct bpf_prog *active_filter = NULL;
                         struct sock_fprog_kern fprog = {
                                 .len = err,
                                 .filter = code,
                         };
 
-                        ppp_lock(ppp);
-                        if (ppp->active_filter) {
-                                bpf_prog_destroy(ppp->active_filter);
-                                ppp->active_filter = NULL;
+                        err = 0;
+                        if (fprog.filter)
+                                err = bpf_prog_create(&active_filter, &fprog);
+                        if (!err) {
+                                ppp_lock(ppp);
+                                if (ppp->active_filter)
+                                        bpf_prog_destroy(ppp->active_filter);
+                                ppp->active_filter = active_filter;
+                                ppp_unlock(ppp);
                         }
-                        if (fprog.filter != NULL)
-                                err = bpf_prog_create(&ppp->active_filter,
-                                                      &fprog);
-                        else
-                                err = 0;
                         kfree(code);
-                        ppp_unlock(ppp);
                 }
                 break;
         }
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 1aff970be33e..1dc628ffce2b 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -506,7 +506,9 @@ static int pptp_getname(struct socket *sock, struct sockaddr *uaddr,
         int len = sizeof(struct sockaddr_pppox);
         struct sockaddr_pppox sp;
 
-        sp.sa_family      = AF_PPPOX;
+        memset(&sp.sa_addr, 0, sizeof(sp.sa_addr));
+
+        sp.sa_family    = AF_PPPOX;
         sp.sa_protocol  = PX_PROTO_PPTP;
         sp.sa_addr.pptp = pppox_sk(sock->sk)->proto.pptp.src_addr;
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index a3420e091689..4d332dc93b70 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -65,6 +65,7 @@
 #include <linux/nsproxy.h>
 #include <linux/virtio_net.h>
 #include <linux/rcupdate.h>
+#include <net/ipv6.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
@@ -174,7 +175,7 @@ struct tun_struct {
         struct net_device       *dev;
         netdev_features_t       set_features;
 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
-                          NETIF_F_TSO6|NETIF_F_UFO)
+                          NETIF_F_TSO6)
 
         int                     vnet_hdr_sz;
         int                     sndbuf;
@@ -1139,6 +1140,8 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 break;
         }
 
+        skb_reset_network_header(skb);
+
         if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
                 pr_debug("GSO!\n");
                 switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
@@ -1149,8 +1152,20 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                {
+                        static bool warned;
+
+                        if (!warned) {
+                                warned = true;
+                                netdev_warn(tun->dev,
+                                            "%s: using disabled UFO feature; please fix this program\n",
+                                            current->comm);
+                        }
                         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+                        if (skb->protocol == htons(ETH_P_IPV6))
+                                ipv6_proxy_select_ident(skb);
                         break;
+                }
                 default:
                         tun->dev->stats.rx_frame_errors++;
                         kfree_skb(skb);
@@ -1179,7 +1194,6 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
         }
 
-        skb_reset_network_header(skb);
         skb_probe_transport_header(skb, 0);
 
         rxhash = skb_get_hash(skb);
@@ -1221,12 +1235,20 @@ static ssize_t tun_put_user(struct tun_struct *tun,
         struct tun_pi pi = { 0, skb->protocol };
         ssize_t total = 0;
         int vlan_offset = 0, copied;
+        int vlan_hlen = 0;
+        int vnet_hdr_sz = 0;
+
+        if (vlan_tx_tag_present(skb))
+                vlan_hlen = VLAN_HLEN;
+
+        if (tun->flags & TUN_VNET_HDR)
+                vnet_hdr_sz = tun->vnet_hdr_sz;
 
         if (!(tun->flags & TUN_NO_PI)) {
                 if ((len -= sizeof(pi)) < 0)
                         return -EINVAL;
 
-                if (len < skb->len) {
+                if (len < skb->len + vlan_hlen + vnet_hdr_sz) {
                         /* Packet will be striped */
                         pi.flags |= TUN_PKT_STRIP;
                 }
@@ -1236,9 +1258,9 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 total += sizeof(pi);
         }
 
-        if (tun->flags & TUN_VNET_HDR) {
+        if (vnet_hdr_sz) {
                 struct virtio_net_hdr gso = { 0 }; /* no info leak */
-                if ((len -= tun->vnet_hdr_sz) < 0)
+                if ((len -= vnet_hdr_sz) < 0)
                         return -EINVAL;
 
                 if (skb_is_gso(skb)) {
@@ -1251,8 +1273,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                                 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                         else if (sinfo->gso_type & SKB_GSO_TCPV6)
                                 gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                        else if (sinfo->gso_type & SKB_GSO_UDP)
-                                gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                         else {
                                 pr_err("unexpected GSO type: "
                                        "0x%x, gso_size %d, hdr_len %d\n",
@@ -1272,7 +1292,8 @@ static ssize_t tun_put_user(struct tun_struct *tun,
 
                 if (skb->ip_summed == CHECKSUM_PARTIAL) {
                         gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
-                        gso.csum_start = skb_checksum_start_offset(skb);
+                        gso.csum_start = skb_checksum_start_offset(skb) +
+                                         vlan_hlen;
                         gso.csum_offset = skb->csum_offset;
                 } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
                         gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
@@ -1281,14 +1302,13 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
                                                sizeof(gso))))
                         return -EFAULT;
-                total += tun->vnet_hdr_sz;
+                total += vnet_hdr_sz;
         }
 
         copied = total;
-        total += skb->len;
-        if (!vlan_tx_tag_present(skb)) {
-                len = min_t(int, skb->len, len);
-        } else {
+        len = min_t(int, skb->len + vlan_hlen, len);
+        total += skb->len + vlan_hlen;
+        if (vlan_hlen) {
                 int copy, ret;
                 struct {
                         __be16 h_vlan_proto;
@@ -1299,8 +1319,6 @@ static ssize_t tun_put_user(struct tun_struct *tun,
                 veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));
 
                 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);
-                len = min_t(int, skb->len + VLAN_HLEN, len);
-                total += VLAN_HLEN;
 
                 copy = min_t(int, vlan_offset, len);
                 ret = skb_copy_datagram_const_iovec(skb, 0, iv, copied, copy);
@@ -1762,11 +1780,6 @@ static int set_offload(struct tun_struct *tun, unsigned long arg)
                                 features |= NETIF_F_TSO6;
                         arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
                 }
-
-                if (arg & TUN_F_UFO) {
-                        features |= NETIF_F_UFO;
-                        arg &= ~TUN_F_UFO;
-                }
         }
 
         /* This gives the user a way to test for new features in future by
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 2c05f6cdb12f..816d511e34d3 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -465,19 +465,7 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf)
                 return ret;
         }
 
-        ret = asix_sw_reset(dev, AX_SWRESET_IPPD | AX_SWRESET_PRL);
-        if (ret < 0)
-                return ret;
-
-        msleep(150);
-
-        ret = asix_sw_reset(dev, AX_SWRESET_CLEAR);
-        if (ret < 0)
-                return ret;
-
-        msleep(150);
-
-        ret = asix_sw_reset(dev, embd_phy ? AX_SWRESET_IPRL : AX_SWRESET_PRTE);
+        ax88772_reset(dev);
 
         /* Read PHYID register *AFTER* the PHY was reset properly */
         phyid = asix_get_phyid(dev);
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index be4275721039..e6338c16081a 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -937,6 +937,7 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)
 {
         struct usbnet *dev = netdev_priv(net);
         struct sockaddr *addr = p;
+        int ret;
 
         if (netif_running(net))
                 return -EBUSY;
@@ -946,8 +947,12 @@ static int ax88179_set_mac_addr(struct net_device *net, void *p)
         memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
 
         /* Set the MAC address */
-        return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+        ret = ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
                                  ETH_ALEN, net->dev_addr);
+        if (ret < 0)
+                return ret;
+
+        return 0;
 }
 
 static const struct net_device_ops ax88179_netdev_ops = {
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 2a32d9167d3b..d3920b54a92c 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -67,6 +67,35 @@ static const u8 mbm_guid[16] = {
         0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
 };
 
+static void usbnet_cdc_update_filter(struct usbnet *dev)
+{
+        struct cdc_state        *info = (void *) &dev->data;
+        struct usb_interface    *intf = info->control;
+
+        u16 cdc_filter =
+            USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED |
+            USB_CDC_PACKET_TYPE_BROADCAST;
+
+        if (dev->net->flags & IFF_PROMISC)
+                cdc_filter |= USB_CDC_PACKET_TYPE_PROMISCUOUS;
+
+        /* FIXME cdc-ether has some multicast code too, though it complains
+         * in routine cases.  info->ether describes the multicast support.
+         * Implement that here, manipulating the cdc filter as needed.
+         */
+
+        usb_control_msg(dev->udev,
+                        usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
+                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
+                        cdc_filter,
+                        intf->cur_altsetting->desc.bInterfaceNumber,
+                        NULL,
+                        0,
+                        USB_CTRL_SET_TIMEOUT
+                );
+}
+
 /* probes control interface, claims data interface, collects the bulk
  * endpoints, activates data interface (if needed), maybe sets MTU.
  * all pure cdc, except for certain firmware workarounds, and knowing
@@ -347,16 +376,8 @@ next_desc:
          * don't do reset all the way. So the packet filter should
          * be set to a sane initial value.
          */
-        usb_control_msg(dev->udev,
-                        usb_sndctrlpipe(dev->udev, 0),
-                        USB_CDC_SET_ETHERNET_PACKET_FILTER,
-                        USB_TYPE_CLASS | USB_RECIP_INTERFACE,
-                        USB_CDC_PACKET_TYPE_ALL_MULTICAST | USB_CDC_PACKET_TYPE_DIRECTED | USB_CDC_PACKET_TYPE_BROADCAST,
-                        intf->cur_altsetting->desc.bInterfaceNumber,
-                        NULL,
-                        0,
-                        USB_CTRL_SET_TIMEOUT
-                );
+        usbnet_cdc_update_filter(dev);
+
         return 0;
 
 bad_desc:
@@ -468,10 +489,6 @@ int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                 return status;
         }
 
-        /* FIXME cdc-ether has some multicast code too, though it complains
-         * in routine cases.  info->ether describes the multicast support.
-         * Implement that here, manipulating the cdc filter as needed.
-         */
         return 0;
 }
 EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
@@ -482,6 +499,7 @@ static const struct driver_info	cdc_info = {
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
+        .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
 };
 
@@ -491,6 +509,7 @@ static const struct driver_info wwan_info = {
         .bind =         usbnet_cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       usbnet_cdc_status,
+        .set_rx_mode =  usbnet_cdc_update_filter,
         .manage_power = usbnet_manage_power,
 };
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 22756db53dca..b8a82b86f909 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -780,6 +780,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x413c, 0x81a4, 8)},    /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a8, 8)},    /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
         {QMI_FIXED_INTF(0x413c, 0x81a9, 8)},    /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+        {QMI_FIXED_INTF(0x03f0, 0x581d, 4)},    /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e3d84c322e4e..c6554c7a8147 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -1162,6 +1162,9 @@ static void intr_callback(struct urb *urb)
         case -ESHUTDOWN:
                 netif_device_detach(tp->netdev);
         case -ENOENT:
+        case -EPROTO:
+                netif_info(tp, intr, tp->netdev,
+                           "Stop submitting intr, status %d\n", status);
                 return;
         case -EOVERFLOW:
                 netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n");
@@ -2891,6 +2894,9 @@ static int rtl8152_open(struct net_device *netdev)
         if (res)
                 goto out;
 
+        /* set speed to 0 to avoid autoresume try to submit rx */
+        tp->speed = 0;
+
         res = usb_autopm_get_interface(tp->intf);
         if (res < 0) {
                 free_all_mem(tp);
@@ -2904,6 +2910,8 @@ static int rtl8152_open(struct net_device *netdev)
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 cancel_delayed_work_sync(&tp->schedule);
+
+                /* disable the tx/rx, if the workqueue has enabled them. */
                 if (tp->speed & LINK_STATUS)
                         tp->rtl_ops.disable(tp);
         }
@@ -2955,10 +2963,7 @@ static int rtl8152_close(struct net_device *netdev)
                  * be disable when autoresume occurs, because the
                  * netif_running() would be false.
                  */
-                if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
-                        rtl_runtime_suspend_enable(tp, false);
-                        clear_bit(SELECTIVE_SUSPEND, &tp->flags);
-                }
+                rtl_runtime_suspend_enable(tp, false);
 
                 tasklet_disable(&tp->tl);
                 tp->rtl_ops.down(tp);
@@ -3205,7 +3210,7 @@ static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
                 netif_device_detach(netdev);
         }
 
-        if (netif_running(netdev)) {
+        if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) {
                 clear_bit(WORK_ENABLE, &tp->flags);
                 usb_kill_urb(tp->intr_urb);
                 tasklet_disable(&tp->tl);
@@ -3253,6 +3258,8 @@ static int rtl8152_resume(struct usb_interface *intf)
                         set_bit(WORK_ENABLE, &tp->flags);
                 }
                 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
+        } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
+                clear_bit(SELECTIVE_SUSPEND, &tp->flags);
         }
 
         mutex_unlock(&tp->control);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 20615bbd693b..3a6770a65d78 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1052,6 +1052,21 @@ static void __handle_link_change(struct usbnet *dev)
         clear_bit(EVENT_LINK_CHANGE, &dev->flags);
 }
 
+static void usbnet_set_rx_mode(struct net_device *net)
+{
+        struct usbnet           *dev = netdev_priv(net);
+
+        usbnet_defer_kevent(dev, EVENT_SET_RX_MODE);
+}
+
+static void __handle_set_rx_mode(struct usbnet *dev)
+{
+        if (dev->driver_info->set_rx_mode)
+                (dev->driver_info->set_rx_mode)(dev);
+
+        clear_bit(EVENT_SET_RX_MODE, &dev->flags);
+}
+
 /* work that cannot be done in interrupt context uses keventd.
  *
  * NOTE:  with 2.5 we could do more of this using completion callbacks,
@@ -1157,6 +1172,10 @@ skip_reset:
         if (test_bit (EVENT_LINK_CHANGE, &dev->flags))
                 __handle_link_change(dev);
 
+        if (test_bit (EVENT_SET_RX_MODE, &dev->flags))
+                __handle_set_rx_mode(dev);
+
+
         if (dev->flags)
                 netdev_dbg(dev->net, "kevent done, flags = 0x%lx\n", dev->flags);
 }
@@ -1525,6 +1544,7 @@ static const struct net_device_ops usbnet_netdev_ops = {
         .ndo_stop               = usbnet_stop,
         .ndo_start_xmit         = usbnet_start_xmit,
         .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_set_rx_mode        = usbnet_set_rx_mode,
         .ndo_change_mtu         = usbnet_change_mtu,
         .ndo_set_mac_address    = eth_mac_addr,
         .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d75256bd1a6a..b0bc8ead47de 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -491,8 +491,17 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
                         break;
                 case VIRTIO_NET_HDR_GSO_UDP:
+                {
+                        static bool warned;
+
+                        if (!warned) {
+                                warned = true;
+                                netdev_warn(dev,
+                                            "host using disabled UFO feature; please fix it\n");
+                        }
                         skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                         break;
+                }
                 case VIRTIO_NET_HDR_GSO_TCPV6:
                         skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
                         break;
@@ -881,8 +890,6 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb)
                         hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
                 else if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6)
                         hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
-                else if (skb_shinfo(skb)->gso_type & SKB_GSO_UDP)
-                        hdr->hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
                 else
                         BUG();
                 if (skb_shinfo(skb)->gso_type & SKB_GSO_TCP_ECN)
@@ -1666,6 +1673,40 @@ static const struct attribute_group virtio_net_mrg_rx_group = {
 };
 #endif
 
+static bool virtnet_fail_on_feature(struct virtio_device *vdev,
+                                    unsigned int fbit,
+                                    const char *fname, const char *dname)
+{
+        if (!virtio_has_feature(vdev, fbit))
+                return false;
+
+        dev_err(&vdev->dev, "device advertises feature %s but not %s",
+                fname, dname);
+
+        return true;
+}
+
+#define VIRTNET_FAIL_ON(vdev, fbit, dbit)                       \
+        virtnet_fail_on_feature(vdev, fbit, #fbit, dbit)
+
+static bool virtnet_validate_features(struct virtio_device *vdev)
+{
+        if (!virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_VQ) &&
+            (VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_RX,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_VLAN,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_GUEST_ANNOUNCE,
+                             "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_MQ, "VIRTIO_NET_F_CTRL_VQ") ||
+             VIRTNET_FAIL_ON(vdev, VIRTIO_NET_F_CTRL_MAC_ADDR,
+                             "VIRTIO_NET_F_CTRL_VQ"))) {
+                return false;
+        }
+
+        return true;
+}
+
 static int virtnet_probe(struct virtio_device *vdev)
 {
         int i, err;
@@ -1673,6 +1714,9 @@ static int virtnet_probe(struct virtio_device *vdev)
         struct virtnet_info *vi;
         u16 max_queue_pairs;
 
+        if (!virtnet_validate_features(vdev))
+                return -EINVAL;
+
         /* Find if host supports multiqueue virtio_net device */
         err = virtio_cread_feature(vdev, VIRTIO_NET_F_MQ,
                                    struct virtio_net_config,
@@ -1705,7 +1749,7 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
 
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
-                        dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
+                        dev->hw_features |= NETIF_F_TSO
                                 | NETIF_F_TSO_ECN | NETIF_F_TSO6;
                 }
                 /* Individual feature bits: what can host handle? */
@@ -1715,11 +1759,9 @@ static int virtnet_probe(struct virtio_device *vdev)
                         dev->hw_features |= NETIF_F_TSO6;
                 if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_ECN))
                         dev->hw_features |= NETIF_F_TSO_ECN;
-                if (virtio_has_feature(vdev, VIRTIO_NET_F_HOST_UFO))
-                        dev->hw_features |= NETIF_F_UFO;
 
                 if (gso)
-                        dev->features |= dev->hw_features & (NETIF_F_ALL_TSO|NETIF_F_UFO);
+                        dev->features |= dev->hw_features & NETIF_F_ALL_TSO;
                 /* (!csum && gso) case will be fixed by register_netdev() */
         }
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_CSUM))
@@ -1757,8 +1799,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* If we can receive ANY GSO packets, we must allocate large ones. */
         if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) ||
             virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN) ||
-            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_UFO))
+            virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_ECN))
                 vi->big_packets = true;
 
         if (virtio_has_feature(vdev, VIRTIO_NET_F_MRG_RXBUF))
@@ -1952,9 +1993,9 @@ static struct virtio_device_id id_table[] = {
 static unsigned int features[] = {
         VIRTIO_NET_F_CSUM, VIRTIO_NET_F_GUEST_CSUM,
         VIRTIO_NET_F_GSO, VIRTIO_NET_F_MAC,
-        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_UFO, VIRTIO_NET_F_HOST_TSO6,
+        VIRTIO_NET_F_HOST_TSO4, VIRTIO_NET_F_HOST_TSO6,
         VIRTIO_NET_F_HOST_ECN, VIRTIO_NET_F_GUEST_TSO4, VIRTIO_NET_F_GUEST_TSO6,
-        VIRTIO_NET_F_GUEST_ECN, VIRTIO_NET_F_GUEST_UFO,
+        VIRTIO_NET_F_GUEST_ECN,
         VIRTIO_NET_F_MRG_RXBUF, VIRTIO_NET_F_STATUS, VIRTIO_NET_F_CTRL_VQ,
         VIRTIO_NET_F_CTRL_RX, VIRTIO_NET_F_CTRL_VLAN,
         VIRTIO_NET_F_GUEST_ANNOUNCE, VIRTIO_NET_F_MQ,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index ca309820d39e..e1e335c339e3 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -67,12 +67,6 @@
 
 #define VXLAN_FLAGS 0x08000000  /* struct vxlanhdr.vx_flags required value. */
 
-/* VXLAN protocol header */
-struct vxlanhdr {
-        __be32 vx_flags;
-        __be32 vx_vni;
-};
-
 /* UDP port for VXLAN traffic.
  * The IANA assigned port is 4789, but the Linux default is 8472
  * for compatibility with early adopters.
@@ -275,13 +269,15 @@ static inline struct vxlan_rdst *first_remote_rtnl(struct vxlan_fdb *fdb)
         return list_first_entry(&fdb->remotes, struct vxlan_rdst, list);
 }
 
-/* Find VXLAN socket based on network namespace and UDP port */
-static struct vxlan_sock *vxlan_find_sock(struct net *net, __be16 port)
+/* Find VXLAN socket based on network namespace, address family and UDP port */
+static struct vxlan_sock *vxlan_find_sock(struct net *net,
+                                          sa_family_t family, __be16 port)
 {
         struct vxlan_sock *vs;
 
         hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
-                if (inet_sk(vs->sock->sk)->inet_sport == port)
+                if (inet_sk(vs->sock->sk)->inet_sport == port &&
+                    inet_sk(vs->sock->sk)->sk.sk_family == family)
                         return vs;
         }
         return NULL;
@@ -300,11 +296,12 @@ static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, u32 id)
 }
 
 /* Look up VNI in a per net namespace table */
-static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, __be16 port)
+static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id,
+                                        sa_family_t family, __be16 port)
 {
         struct vxlan_sock *vs;
 
-        vs = vxlan_find_sock(net, port);
+        vs = vxlan_find_sock(net, family, port);
         if (!vs)
                 return NULL;
 
@@ -621,6 +618,8 @@ static int vxlan_gro_complete(struct sk_buff *skb, int nhoff)
         int vxlan_len  = sizeof(struct vxlanhdr) + sizeof(struct ethhdr);
         int err = -ENOSYS;
 
+        udp_tunnel_gro_complete(skb, nhoff);
+
         eh = (struct ethhdr *)(skb->data + nhoff + sizeof(struct vxlanhdr));
         type = eh->h_proto;
 
@@ -1771,7 +1770,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         struct vxlan_dev *dst_vxlan;
 
                         ip_rt_put(rt);
-                        dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
+                        dst_vxlan = vxlan_find_vni(vxlan->net, vni,
+                                                   dst->sa.sa_family, dst_port);
                         if (!dst_vxlan)
                                 goto tx_error;
                         vxlan_encap_bypass(skb, vxlan, dst_vxlan);
@@ -1825,7 +1825,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
                         struct vxlan_dev *dst_vxlan;
 
                         dst_release(ndst);
-                        dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
+                        dst_vxlan = vxlan_find_vni(vxlan->net, vni,
+                                                   dst->sa.sa_family, dst_port);
                         if (!dst_vxlan)
                                 goto tx_error;
                         vxlan_encap_bypass(skb, vxlan, dst_vxlan);
@@ -1985,13 +1986,15 @@ static int vxlan_init(struct net_device *dev)
         struct vxlan_dev *vxlan = netdev_priv(dev);
         struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
         struct vxlan_sock *vs;
+        bool ipv6 = vxlan->flags & VXLAN_F_IPV6;
 
         dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
         spin_lock(&vn->sock_lock);
-        vs = vxlan_find_sock(vxlan->net, vxlan->dst_port);
+        vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
+                             vxlan->dst_port);
         if (vs) {
                 /* If we have a socket with same port already, reuse it */
                 atomic_inc(&vs->refcnt);
@@ -2382,6 +2385,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
 {
         struct vxlan_net *vn = net_generic(net, vxlan_net_id);
         struct vxlan_sock *vs;
+        bool ipv6 = flags & VXLAN_F_IPV6;
 
         vs = vxlan_socket_create(net, port, rcv, data, flags);
         if (!IS_ERR(vs))
@@ -2391,7 +2395,7 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
                 return vs;
 
         spin_lock(&vn->sock_lock);
-        vs = vxlan_find_sock(net, port);
+        vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
         if (vs) {
                 if (vs->rcv == rcv)
                         atomic_inc(&vs->refcnt);
@@ -2550,7 +2554,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
             nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
                 vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
 
-        if (vxlan_find_vni(net, vni, vxlan->dst_port)) {
+        if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
+                           vxlan->dst_port)) {
                 pr_info("duplicate VNI %u\n", vni);
                 return -EEXIST;
         }
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index e5ba6faf3281..86907e5ba6ca 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -80,6 +80,7 @@ struct reg_dmn_pair_mapping {
 
 struct ath_regulatory {
         char alpha2[2];
+        enum nl80211_dfs_regions region;
         u16 country_code;
         u16 max_power_level;
         u16 current_rd;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index 697c4ae90af0..1e8ea5e4d4ca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -664,6 +664,19 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
                 ah->enabled_cals |= TX_CL_CAL;
         else
                 ah->enabled_cals &= ~TX_CL_CAL;
+
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah) || AR_SREV_9550(ah)) {
+                if (ah->is_clk_25mhz) {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e7ae);
+                } else {
+                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
+                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
+                        REG_WRITE(ah, AR_SLP32_INC, 0x0001e800);
+                }
+                udelay(100);
+        }
 }
 
 static void ar9003_hw_prog_ini(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index c6dd7f1fed65..33b0c7aef2ea 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -368,11 +368,11 @@ void ath9k_cmn_update_txpow(struct ath_hw *ah, u16 cur_txpow,
 {
         struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
 
-        if (reg->power_limit != new_txpow) {
+        if (reg->power_limit != new_txpow)
                 ath9k_hw_set_txpowerlimit(ah, new_txpow, false);
-                /* read back in case value is clamped */
-                *txpower = reg->max_power_level;
-        }
+
+        /* read back in case value is clamped */
+        *txpower = reg->max_power_level;
 }
 EXPORT_SYMBOL(ath9k_cmn_update_txpow);
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 46f20a309b5f..5c45e787814e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -455,7 +455,7 @@ static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                          "%2d          %2x      %1x     %2x           %2x\n",
                          i, (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
                          (*qcuBase & (0x8 << qcuOffset)) >> (qcuOffset + 3),
-                         val[2] & (0x7 << (i * 3)) >> (i * 3),
+                         (val[2] & (0x7 << (i * 3))) >> (i * 3),
                          (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8be4b1453394..2ad605760e21 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -861,19 +861,6 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         udelay(RTC_PLL_SETTLE_DELAY);
 
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
-
-        if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
-                if (ah->is_clk_25mhz) {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x17c << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f3d7);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e7ae);
-                } else {
-                        REG_WRITE(ah, AR_RTC_DERIVED_CLK, 0x261 << 1);
-                        REG_WRITE(ah, AR_SLP32_MODE, 0x0010f400);
-                        REG_WRITE(ah,  AR_SLP32_INC, 0x0001e800);
-                }
-                udelay(100);
-        }
 }
 
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 156a944134dc..3bd030494986 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -734,6 +734,32 @@ static const struct ieee80211_iface_combination if_comb[] = {
 #endif
 };
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+static void ath9k_set_mcc_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
+        hw->flags |= IEEE80211_HW_QUEUE_CONTROL;
+        hw->queues = ATH9K_NUM_TX_QUEUES;
+        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
+        hw->wiphy->iface_combinations = if_comb_multi;
+        hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
+        hw->wiphy->max_scan_ssids = 255;
+        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+        hw->wiphy->max_remain_on_channel_duration = 10000;
+        hw->chanctx_data_size = sizeof(void *);
+        hw->extra_beacon_tailroom =
+                sizeof(struct ieee80211_p2p_noa_attr) + 9;
+
+        ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
+}
+#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
+
 static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
@@ -746,7 +772,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_SPECTRUM_MGMT |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE |
-                IEEE80211_HW_QUEUE_CONTROL |
                 IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
 
         if (ath9k_ps_enable)
@@ -781,24 +806,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                         hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb);
         }
 
-#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
-
-        if (ath9k_is_chanctx_enabled()) {
-                hw->wiphy->interface_modes &= ~ BIT(NL80211_IFTYPE_WDS);
-                hw->wiphy->iface_combinations = if_comb_multi;
-                hw->wiphy->n_iface_combinations = ARRAY_SIZE(if_comb_multi);
-                hw->wiphy->max_scan_ssids = 255;
-                hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-                hw->wiphy->max_remain_on_channel_duration = 10000;
-                hw->chanctx_data_size = sizeof(void *);
-                hw->extra_beacon_tailroom =
-                        sizeof(struct ieee80211_p2p_noa_attr) + 9;
-
-                ath_dbg(common, CHAN_CTX, "Use channel contexts\n");
-        }
-
-#endif /* CONFIG_ATH9K_CHANNEL_CONTEXT */
-
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
         hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
@@ -808,12 +815,7 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        /* allow 4 queues per channel context +
-         * 1 cab queue + 1 offchannel tx queue
-         */
-        hw->queues = ATH9K_NUM_TX_QUEUES;
-        /* last queue for offchannel */
-        hw->offchannel_tx_hw_queue = hw->queues - 1;
+        hw->queues = 4;
         hw->max_rates = 4;
         hw->max_listen_interval = 10;
         hw->max_rate_tries = 10;
@@ -837,6 +839,9 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &common->sbands[IEEE80211_BAND_5GHZ];
 
+#ifdef CONFIG_ATH9K_CHANNEL_CONTEXT
+        ath9k_set_mcc_capab(sc, hw);
+#endif
         ath9k_init_wow(hw);
         ath9k_cmn_reload_chainmask(ah);
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6f6a974f7fdb..4f18a6be0c7d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -974,9 +974,8 @@ void ath9k_calculate_iter_data(struct ath_softc *sc,
         struct ath_vif *avp;
 
         /*
-         * Pick the MAC address of the first interface as the new hardware
-         * MAC address. The hardware will use it together with the BSSID mask
-         * when matching addresses.
+         * The hardware will use primary station addr together with the
+         * BSSID mask when matching addresses.
          */
         memset(iter_data, 0, sizeof(*iter_data));
         memset(&iter_data->mask, 0xff, ETH_ALEN);
@@ -1162,6 +1161,9 @@ static void ath9k_assign_hw_queues(struct ieee80211_hw *hw,
 {
         int i;
 
+        if (!ath9k_is_chanctx_enabled())
+                return;
+
         for (i = 0; i < IEEE80211_NUM_ACS; i++)
                 vif->hw_queue[i] = i;
 
@@ -1202,6 +1204,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
                 list_add_tail(&avp->list, &avp->chanctx->vifs);
         }
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         ath9k_assign_hw_queues(hw, vif);
 
         an->sc = sc;
@@ -1271,6 +1275,8 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 
         ath_tx_node_cleanup(sc, &avp->mcast_node);
 
+        ath9k_calculate_summary_state(sc, avp->chanctx);
+
         mutex_unlock(&sc->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 493a183d0aaf..d6e54a3c88f6 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -169,7 +169,10 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 
         if (txq->stopped &&
             txq->pending_frames < sc->tx.txq_max_pending[q]) {
-                ieee80211_wake_queue(sc->hw, info->hw_queue);
+                if (ath9k_is_chanctx_enabled())
+                        ieee80211_wake_queue(sc->hw, info->hw_queue);
+                else
+                        ieee80211_wake_queue(sc->hw, q);
                 txq->stopped = false;
         }
 }
@@ -2247,7 +2250,10 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 fi->txq = q;
                 if (++txq->pending_frames > sc->tx.txq_max_pending[q] &&
                     !txq->stopped) {
-                        ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        if (ath9k_is_chanctx_enabled())
+                                ieee80211_stop_queue(sc->hw, info->hw_queue);
+                        else
+                                ieee80211_stop_queue(sc->hw, q);
                         txq->stopped = true;
                 }
         }
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 415393dfb6fc..06ea6cc9e30a 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -515,6 +515,7 @@ void ath_reg_notifier_apply(struct wiphy *wiphy,
         if (!request)
                 return;
 
+        reg->region = request->dfs_region;
         switch (request->initiator) {
         case NL80211_REGDOM_SET_BY_CORE:
                 /*
@@ -779,6 +780,19 @@ u32 ath_regd_get_band_ctl(struct ath_regulatory *reg,
                 return SD_NO_CTL;
         }
 
+        if (ath_regd_get_eepromRD(reg) == CTRY_DEFAULT) {
+                switch (reg->region) {
+                case NL80211_DFS_FCC:
+                        return CTL_FCC;
+                case NL80211_DFS_ETSI:
+                        return CTL_ETSI;
+                case NL80211_DFS_JP:
+                        return CTL_MKK;
+                default:
+                        break;
+                }
+        }
+
         switch (band) {
         case IEEE80211_BAND_2GHZ:
                 return reg->regpair->reg_2ghz_ctl;
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index 1dfc682a8055..ee27b06074e1 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -300,9 +300,7 @@ void b43_phy_write(struct b43_wldev *dev, u16 reg, u16 value)
 
 void b43_phy_copy(struct b43_wldev *dev, u16 destreg, u16 srcreg)
 {
-        assert_mac_suspended(dev);
-        dev->phy.ops->phy_write(dev, destreg,
-                dev->phy.ops->phy_read(dev, srcreg));
+        b43_phy_write(dev, destreg, b43_phy_read(dev, srcreg));
 }
 
 void b43_phy_mask(struct b43_wldev *dev, u16 offset, u16 mask)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index f55f625fd06b..d20d4e6f391a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -670,7 +670,6 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                                   struct brcmf_sdio_dev *sdiodev)
 {
         int i;
-        uint fw_len, nv_len;
         char end;
 
         for (i = 0; i < ARRAY_SIZE(brcmf_fwname_data); i++) {
@@ -684,25 +683,25 @@ static int brcmf_sdio_get_fwnames(struct brcmf_chip *ci,
                 return -ENODEV;
         }
 
-        fw_len = sizeof(sdiodev->fw_name) - 1;
-        nv_len = sizeof(sdiodev->nvram_name) - 1;
         /* check if firmware path is provided by module parameter */
         if (brcmf_firmware_path[0] != '\0') {
-                strncpy(sdiodev->fw_name, brcmf_firmware_path, fw_len);
-                strncpy(sdiodev->nvram_name, brcmf_firmware_path, nv_len);
-                fw_len -= strlen(sdiodev->fw_name);
-                nv_len -= strlen(sdiodev->nvram_name);
+                strlcpy(sdiodev->fw_name, brcmf_firmware_path,
+                        sizeof(sdiodev->fw_name));
+                strlcpy(sdiodev->nvram_name, brcmf_firmware_path,
+                        sizeof(sdiodev->nvram_name));
 
                 end = brcmf_firmware_path[strlen(brcmf_firmware_path) - 1];
                 if (end != '/') {
-                        strncat(sdiodev->fw_name, "/", fw_len);
-                        strncat(sdiodev->nvram_name, "/", nv_len);
-                        fw_len--;
-                        nv_len--;
+                        strlcat(sdiodev->fw_name, "/",
+                                sizeof(sdiodev->fw_name));
+                        strlcat(sdiodev->nvram_name, "/",
+                                sizeof(sdiodev->nvram_name));
                 }
         }
-        strncat(sdiodev->fw_name, brcmf_fwname_data[i].bin, fw_len);
-        strncat(sdiodev->nvram_name, brcmf_fwname_data[i].nv, nv_len);
+        strlcat(sdiodev->fw_name, brcmf_fwname_data[i].bin,
+                sizeof(sdiodev->fw_name));
+        strlcat(sdiodev->nvram_name, brcmf_fwname_data[i].nv,
+                sizeof(sdiodev->nvram_name));
 
         return 0;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/of.c b/drivers/net/wireless/brcm80211/brcmfmac/of.c
index f05f5270fec1..927bffd5be64 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/of.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/of.c
@@ -40,8 +40,8 @@ void brcmf_of_probe(struct brcmf_sdio_dev *sdiodev)
                 return;
 
         irq = irq_of_parse_and_map(np, 0);
-        if (irq < 0) {
-                brcmf_err("interrupt could not be mapped: err=%d\n", irq);
+        if (!irq) {
+                brcmf_err("interrupt could not be mapped\n");
                 devm_kfree(dev, sdiodev->pdata);
                 return;
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
index 8c0632ec9f7a..16fef3382019 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/pcie.c
@@ -19,10 +19,10 @@
 #include <linux/pci.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
-#include <linux/unaligned/access_ok.h>
 #include <linux/interrupt.h>
 #include <linux/bcma/bcma.h>
 #include <linux/sched.h>
+#include <asm/unaligned.h>
 
 #include <soc.h>
 #include <chipcommon.h>
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..875d1142c8b0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
                 goto finalize;
         }
 
-        if (!brcmf_usb_ioctl_resp_wait(devinfo))
+        if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
+                usb_kill_urb(devinfo->ctl_urb);
                 ret = -ETIMEDOUT;
-        else
+        } else {
                 memcpy(buffer, tmpbuf, buflen);
+        }
 
 finalize:
         kfree(tmpbuf);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 28fa25b509db..39b45c038a93 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -299,6 +299,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         primary_offset = ch->center_freq1 - ch->chan->center_freq;
         switch (ch->width) {
         case NL80211_CHAN_WIDTH_20:
+        case NL80211_CHAN_WIDTH_20_NOHT:
                 ch_inf.bw = BRCMU_CHAN_BW_20;
                 WARN_ON(primary_offset != 0);
                 break;
@@ -323,6 +324,10 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
                                 ch_inf.sb = BRCMU_CHAN_SB_LU;
                 }
                 break;
+        case NL80211_CHAN_WIDTH_80P80:
+        case NL80211_CHAN_WIDTH_160:
+        case NL80211_CHAN_WIDTH_5:
+        case NL80211_CHAN_WIDTH_10:
         default:
                 WARN_ON_ONCE(1);
         }
@@ -333,6 +338,7 @@ static u16 chandef_to_chanspec(struct brcmu_d11inf *d11inf,
         case IEEE80211_BAND_5GHZ:
                 ch_inf.band = BRCMU_CHAN_BAND_5G;
                 break;
+        case IEEE80211_BAND_60GHZ:
         default:
                 WARN_ON_ONCE(1);
         }
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 2364a3c09b9e..cae692ff1013 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1095,6 +1095,7 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                              u32 queues, bool drop)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
+        u32 scd_queues;
 
         mutex_lock(&priv->mutex);
         IWL_DEBUG_MAC80211(priv, "enter\n");
@@ -1108,18 +1109,19 @@ static void iwlagn_mac_flush(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                 goto done;
         }
 
-        /*
-         * mac80211 will not push any more frames for transmit
-         * until the flush is completed
-         */
-        if (drop) {
-                IWL_DEBUG_MAC80211(priv, "send flush command\n");
-                if (iwlagn_txfifo_flush(priv, 0)) {
-                        IWL_ERR(priv, "flush request fail\n");
-                        goto done;
-                }
+        scd_queues = BIT(priv->cfg->base_params->num_of_queues) - 1;
+        scd_queues &= ~(BIT(IWL_IPAN_CMD_QUEUE_NUM) |
+                        BIT(IWL_DEFAULT_CMD_QUEUE_NUM));
+
+        if (vif)
+                scd_queues &= ~BIT(vif->hw_queue[IEEE80211_AC_VO]);
+
+        IWL_DEBUG_TX_QUEUES(priv, "Flushing SCD queues: 0x%x\n", scd_queues);
+        if (iwlagn_txfifo_flush(priv, scd_queues)) {
+                IWL_ERR(priv, "flush request fail\n");
+                goto done;
         }
-        IWL_DEBUG_MAC80211(priv, "wait transmit/flush all frames\n");
+        IWL_DEBUG_TX_QUEUES(priv, "wait transmit/flush all frames\n");
         iwl_trans_wait_tx_queue_empty(priv->trans, 0xffffffff);
 done:
         mutex_unlock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-8000.c b/drivers/net/wireless/iwlwifi/iwl-8000.c
index e4351487ca72..d2b7234b1c73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-8000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-8000.c
@@ -82,7 +82,8 @@
 #define IWL8000_TX_POWER_VERSION        0xffff /* meaningless */
 
 #define IWL8000_FW_PRE "iwlwifi-8000"
-#define IWL8000_MODULE_FIRMWARE(api) IWL8000_FW_PRE __stringify(api) ".ucode"
+#define IWL8000_MODULE_FIRMWARE(api) \
+        IWL8000_FW_PRE "-" __stringify(api) ".ucode"
 
 #define NVM_HW_SECTION_NUM_FAMILY_8000          10
 #define DEFAULT_NVM_FILE_FAMILY_8000            "iwl_nvm_8000.bin"
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 9eb85249e89c..d8fc548c0d6c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -563,6 +563,7 @@ enum iwl_trans_state {
  *      Set during transport allocation.
  * @hw_id_str: a string with info about HW ID. Set during transport allocation.
  * @pm_support: set to true in start_hw if link pm is supported
+ * @ltr_enabled: set to true if the LTR is enabled
  * @dev_cmd_pool: pool for Tx cmd allocation - for internal use only.
  *      The user should use iwl_trans_{alloc,free}_tx_cmd.
  * @dev_cmd_headroom: room needed for the transport's private use before the
@@ -589,6 +590,7 @@ struct iwl_trans {
         u8 rx_mpdu_cmd, rx_mpdu_cmd_hdr_size;
 
         bool pm_support;
+        bool ltr_enabled;
 
         /* The following fields are internal only */
         struct kmem_cache *dev_cmd_pool;
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
index 8df2021f9856..da2ffb785194 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
@@ -303,8 +303,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x28412201),
-        cpu_to_le32(0x11118451),
+        cpu_to_le32(0x2e402280),
+        cpu_to_le32(0x7711a751),
 };
 
 struct corunning_block_luts {
diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
index 585c0ab4a3ec..8a1d2f33d5b7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
@@ -291,8 +291,8 @@ static const __le64 iwl_ci_mask[][3] = {
 };
 
 static const __le32 iwl_bt_mprio_lut[BT_COEX_MULTI_PRIO_LUT_SIZE] = {
-        cpu_to_le32(0x28412201),
-        cpu_to_le32(0x11118451),
+        cpu_to_le32(0x2e402280),
+        cpu_to_le32(0x7711a751),
 };
 
 struct corunning_block_luts {
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 27dd86395b39..2fd8ad4633e0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -68,13 +68,46 @@
 
 /* Power Management Commands, Responses, Notifications */
 
+/**
+ * enum iwl_ltr_config_flags - masks for LTR config command flags
+ * @LTR_CFG_FLAG_FEATURE_ENABLE: Feature operational status
+ * @LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS: allow LTR change on shadow
+ *      memory access
+ * @LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH: allow LTR msg send on ANY LTR
+ *      reg change
+ * @LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3: allow LTR msg send on transition from
+ *      D0 to D3
+ * @LTR_CFG_FLAG_SW_SET_SHORT: fixed static short LTR register
+ * @LTR_CFG_FLAG_SW_SET_LONG: fixed static short LONG register
+ * @LTR_CFG_FLAG_DENIE_C10_ON_PD: allow going into C10 on PD
+ */
+enum iwl_ltr_config_flags {
+        LTR_CFG_FLAG_FEATURE_ENABLE = BIT(0),
+        LTR_CFG_FLAG_HW_DIS_ON_SHADOW_REG_ACCESS = BIT(1),
+        LTR_CFG_FLAG_HW_EN_SHRT_WR_THROUGH = BIT(2),
+        LTR_CFG_FLAG_HW_DIS_ON_D0_2_D3 = BIT(3),
+        LTR_CFG_FLAG_SW_SET_SHORT = BIT(4),
+        LTR_CFG_FLAG_SW_SET_LONG = BIT(5),
+        LTR_CFG_FLAG_DENIE_C10_ON_PD = BIT(6),
+};
+
+/**
+ * struct iwl_ltr_config_cmd - configures the LTR
+ * @flags: See %enum iwl_ltr_config_flags
+ */
+struct iwl_ltr_config_cmd {
+        __le32 flags;
+        __le32 static_long;
+        __le32 static_short;
+} __packed;
+
 /* Radio LP RX Energy Threshold measured in dBm */
 #define POWER_LPRX_RSSI_THRESHOLD       75
 #define POWER_LPRX_RSSI_THRESHOLD_MAX   94
 #define POWER_LPRX_RSSI_THRESHOLD_MIN   30
 
 /**
- * enum iwl_scan_flags - masks for power table command flags
+ * enum iwl_power_flags - masks for power table command flags
  * @POWER_FLAGS_POWER_SAVE_ENA_MSK: '1' Allow to save power by turning off
  *              receiver and transmitter. '0' - does not allow.
  * @POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK: '0' Driver disables power management,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index 667a92274c87..c62575d86bcd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -157,6 +157,7 @@ enum {
         /* Power - legacy power table command */
         POWER_TABLE_CMD = 0x77,
         PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78,
+        LTR_CONFIG = 0xee,
 
         /* Thermal Throttling*/
         REPLY_THERMAL_MNG_BACKOFF = 0x7e,
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 23fd711a67e4..eb03943f8463 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -284,7 +284,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (WARN_ON_ONCE(mvm->init_ucode_complete))
+        if (WARN_ON_ONCE(mvm->init_ucode_complete || mvm->calibrating))
                 return 0;
 
         iwl_init_notification_wait(&mvm->notif_wait,
@@ -334,6 +334,8 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 goto out;
         }
 
+        mvm->calibrating = true;
+
         /* Send TX valid antennas before triggering calibrations */
         ret = iwl_send_tx_ant_cfg(mvm, mvm->fw->valid_tx_ant);
         if (ret)
@@ -358,11 +360,17 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                         MVM_UCODE_CALIB_TIMEOUT);
         if (!ret)
                 mvm->init_ucode_complete = true;
+
+        if (ret && iwl_mvm_is_radio_killed(mvm)) {
+                IWL_DEBUG_RF_KILL(mvm, "RFKILL while calibrating.\n");
+                ret = 1;
+        }
         goto out;
 
 error:
         iwl_remove_notification(&mvm->notif_wait, &calib_wait);
 out:
+        mvm->calibrating = false;
         if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
                 /* we want to debug INIT and we have no NVM - fake */
                 mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
@@ -480,6 +488,15 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         /* Initialize tx backoffs to the minimal possible */
         iwl_mvm_tt_tx_backoff(mvm, 0);
 
+        if (mvm->trans->ltr_enabled) {
+                struct iwl_ltr_config_cmd cmd = {
+                        .flags = cpu_to_le32(LTR_CFG_FLAG_FEATURE_ENABLE),
+                };
+
+                WARN_ON(iwl_mvm_send_cmd_pdu(mvm, LTR_CONFIG, 0,
+                                             sizeof(cmd), &cmd));
+        }
+
         ret = iwl_mvm_power_update_device(mvm);
         if (ret)
                 goto error;
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index c7a73c68bdab..b62405865b25 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -526,7 +526,8 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
         }
 
         if (IEEE80211_SKB_CB(skb)->hw_queue == IWL_MVM_OFFCHANNEL_QUEUE &&
-            !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
+            !test_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status) &&
+            !test_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
                 goto drop;
 
         /* treat non-bufferable MMPDUs as broadcast if sta is sleeping */
@@ -787,6 +788,7 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
         mvm->ps_disabled = false;
+        mvm->calibrating = false;
 
         /* just in case one was running */
         ieee80211_remain_on_channel_expired(mvm->hw);
@@ -1734,6 +1736,13 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
         if (changes & BSS_CHANGED_BEACON &&
             iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
                 IWL_WARN(mvm, "Failed updating beacon data\n");
+
+        if (changes & BSS_CHANGED_TXPOWER) {
+                IWL_DEBUG_CALIB(mvm, "Changing TX Power to %d\n",
+                                bss_conf->txpower);
+                iwl_mvm_set_tx_power(mvm, vif, bss_conf->txpower);
+        }
+
 }
 
 static void iwl_mvm_bss_info_changed(struct ieee80211_hw *hw,
@@ -2367,14 +2376,19 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
         /* Set the node address */
         memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
 
+        lockdep_assert_held(&mvm->mutex);
+
+        spin_lock_bh(&mvm->time_event_lock);
+
+        if (WARN_ON(te_data->id == HOT_SPOT_CMD)) {
+                spin_unlock_bh(&mvm->time_event_lock);
+                return -EIO;
+        }
+
         te_data->vif = vif;
         te_data->duration = duration;
         te_data->id = HOT_SPOT_CMD;
 
-        lockdep_assert_held(&mvm->mutex);
-
-        spin_lock_bh(&mvm->time_event_lock);
-        list_add_tail(&te_data->list, &mvm->time_event_list);
         spin_unlock_bh(&mvm->time_event_lock);
 
         /*
@@ -2430,22 +2444,23 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
                            duration, type);
 
+        mutex_lock(&mvm->mutex);
+
         switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 /* Use aux roc framework (HS20) */
                 ret = iwl_mvm_send_aux_roc_cmd(mvm, channel,
                                                vif, duration);
-                return ret;
+                goto out_unlock;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* handle below */
                 break;
         default:
                 IWL_ERR(mvm, "vif isn't P2P_DEVICE: %d\n", vif->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out_unlock;
         }
 
-        mutex_lock(&mvm->mutex);
-
         for (i = 0; i < NUM_PHY_CTX; i++) {
                 phy_ctxt = &mvm->phy_ctxts[i];
                 if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index b153ced7015b..845429c88cf4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -548,6 +548,7 @@ struct iwl_mvm {
         enum iwl_ucode_type cur_ucode;
         bool ucode_loaded;
         bool init_ucode_complete;
+        bool calibrating;
         u32 error_event_table;
         u32 log_event_table;
         u32 umac_error_event_table;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 15aa298ee79c..5b719ee8e789 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -336,6 +336,7 @@ static const char *const iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(DTS_MEASUREMENT_NOTIFICATION),
         CMD(REPLY_THERMAL_MNG_BACKOFF),
         CMD(MAC_PM_POWER_TABLE),
+        CMD(LTR_CONFIG),
         CMD(BT_COEX_CI),
         CMD(BT_COEX_UPDATE_SW_BOOST),
         CMD(BT_COEX_UPDATE_CORUN_LUT),
@@ -423,6 +424,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         }
         mvm->sf_state = SF_UNINIT;
         mvm->low_latency_agg_frame_limit = 6;
+        mvm->cur_ucode = IWL_UCODE_INIT;
 
         mutex_init(&mvm->mutex);
         mutex_init(&mvm->d0i3_suspend_mutex);
@@ -751,6 +753,7 @@ void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
 static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+        bool calibrating = ACCESS_ONCE(mvm->calibrating);
 
         if (state)
                 set_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
@@ -759,7 +762,15 @@ static bool iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 
-        return state && mvm->cur_ucode != IWL_UCODE_INIT;
+        /* iwl_run_init_mvm_ucode is waiting for results, abort it */
+        if (calibrating)
+                iwl_abort_notification_waits(&mvm->notif_wait);
+
+        /*
+         * Stop the device if we run OPERATIONAL firmware or if we are in the
+         * middle of the calibrations.
+         */
+        return state && (mvm->cur_ucode != IWL_UCODE_INIT || calibrating);
 }
 
 static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index cb85e63c20aa..7554f7053830 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -459,7 +459,8 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                                 basic_ssid ? 1 : 0);
 
         cmd->tx_cmd.tx_flags = cpu_to_le32(TX_CMD_FLG_SEQ_CTL |
-                                           TX_CMD_FLG_BT_DIS);
+                                           3 << TX_CMD_FLG_BT_PRIO_POS);
+
         cmd->tx_cmd.sta_id = mvm->aux_sta.sta_id;
         cmd->tx_cmd.life_time = cpu_to_le32(TX_CMD_LIFE_TIME_INFINITE);
         cmd->tx_cmd.rate_n_flags =
@@ -601,16 +602,6 @@ static int iwl_mvm_cancel_regular_scan(struct iwl_mvm *mvm)
                                                SCAN_COMPLETE_NOTIFICATION };
         int ret;
 
-        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
-                return 0;
-
-        if (iwl_mvm_is_radio_killed(mvm)) {
-                ieee80211_scan_completed(mvm->hw, true);
-                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
-                mvm->scan_status = IWL_MVM_SCAN_NONE;
-                return 0;
-        }
-
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
@@ -1399,6 +1390,16 @@ int iwl_mvm_unified_sched_scan_lmac(struct iwl_mvm *mvm,
 
 int iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
 {
+        if (mvm->scan_status == IWL_MVM_SCAN_NONE)
+                return 0;
+
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                iwl_mvm_unref(mvm, IWL_MVM_REF_SCAN);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return 0;
+        }
+
         if (mvm->fw->ucode_capa.api[0] & IWL_UCODE_TLV_API_LMAC_SCAN)
                 return iwl_mvm_scan_offload_stop(mvm, true);
         return iwl_mvm_cancel_regular_scan(mvm);
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index b7f9e61d14e2..6dfad230be5e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -305,8 +305,8 @@ static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
                 te_data->running = false;
                 te_data->vif = NULL;
                 te_data->uid = 0;
+                te_data->id = TE_MAX;
         } else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
-                set_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status);
                 set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
                 te_data->running = true;
                 ieee80211_ready_on_channel(mvm->hw); /* Start TE */
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 1cb793a498ac..c6a517c771df 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -175,14 +175,10 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
 
         /*
          * for data packets, rate info comes from the table inside the fw. This
-         * table is controlled by LINK_QUALITY commands. Exclude ctrl port
-         * frames like EAPOLs which should be treated as mgmt frames. This
-         * avoids them being sent initially in high rates which increases the
-         * chances for completion of the 4-Way handshake.
+         * table is controlled by LINK_QUALITY commands
          */
 
-        if (ieee80211_is_data(fc) && sta &&
-            !(info->control.flags & IEEE80211_TX_CTRL_PORT_CTRL_PROTO)) {
+        if (ieee80211_is_data(fc) && sta) {
                 tx_cmd->initial_rate_index = 0;
                 tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
                 return;
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1393bac0025c..dd2f3f8baa9d 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -174,6 +174,7 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u16 lctl;
+        u16 cap;
 
         /*
          * HW bug W/A for instability in PCIe bus L0S->L1 transition.
@@ -184,16 +185,17 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
          *    power savings, even without L1.
          */
         pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_LNKCTL, &lctl);
-        if (lctl & PCI_EXP_LNKCTL_ASPM_L1) {
-                /* L1-ASPM enabled; disable(!) L0S */
+        if (lctl & PCI_EXP_LNKCTL_ASPM_L1)
                 iwl_set_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-                dev_info(trans->dev, "L1 Enabled; Disabling L0S\n");
-        } else {
-                /* L1-ASPM disabled; enable(!) L0S */
+        else
                 iwl_clear_bit(trans, CSR_GIO_REG, CSR_GIO_REG_VAL_L0S_ENABLED);
-                dev_info(trans->dev, "L1 Disabled; Enabling L0S\n");
-        }
         trans->pm_support = !(lctl & PCI_EXP_LNKCTL_ASPM_L0S);
+
+        pcie_capability_read_word(trans_pcie->pci_dev, PCI_EXP_DEVCTL2, &cap);
+        trans->ltr_enabled = cap & PCI_EXP_DEVCTL2_LTR_EN;
+        dev_info(trans->dev, "L1 %sabled - LTR %sabled\n",
+                 (lctl & PCI_EXP_LNKCTL_ASPM_L1) ? "En" : "Dis",
+                 trans->ltr_enabled ? "En" : "Dis");
 }
 
 /*
@@ -428,7 +430,7 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
         ret = iwl_poll_bit(trans, CSR_RESET,
                            CSR_RESET_REG_FLAG_MASTER_DISABLED,
                            CSR_RESET_REG_FLAG_MASTER_DISABLED, 100);
-        if (ret)
+        if (ret < 0)
                 IWL_WARN(trans, "Master Disable Timed Out, 100 usec\n");
 
         IWL_DEBUG_INFO(trans, "stop master\n");
@@ -544,7 +546,7 @@ static int iwl_pcie_prepare_card_hw(struct iwl_trans *trans)
                 msleep(25);
         }
 
-        IWL_DEBUG_INFO(trans, "got NIC after %d iterations\n", iter);
+        IWL_ERR(trans, "Couldn't prepare the card\n");
 
         return ret;
 }
@@ -913,7 +915,8 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
          * restart. So don't process again if the device is
          * already dead.
          */
-        if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+        if (test_and_clear_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
+                IWL_DEBUG_INFO(trans, "DEVICE_ENABLED bit was set and is now cleared\n");
                 iwl_pcie_tx_stop(trans);
                 iwl_pcie_rx_stop(trans);
 
@@ -943,7 +946,6 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         /* clear all status bits */
         clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
         clear_bit(STATUS_INT_ENABLED, &trans->status);
-        clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
         clear_bit(STATUS_TPOWER_PMI, &trans->status);
         clear_bit(STATUS_RFKILL, &trans->status);
 
@@ -1043,7 +1045,7 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                            CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY,
                            25000);
-        if (ret) {
+        if (ret < 0) {
                 IWL_ERR(trans, "Failed to resume the device (mac ready)\n");
                 return ret;
         }
@@ -1892,8 +1894,7 @@ static u32 iwl_trans_pcie_dump_prph(struct iwl_trans *trans,
                 int reg;
                 __le32 *val;
 
-                prph_len += sizeof(*data) + sizeof(*prph) +
-                        num_bytes_in_chunk;
+                prph_len += sizeof(**data) + sizeof(*prph) + num_bytes_in_chunk;
 
                 (*data)->type = cpu_to_le32(IWL_FW_ERROR_DUMP_PRPH);
                 (*data)->len = cpu_to_le32(sizeof(*prph) +
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index babbdc1ce741..c9ad4cf1adfb 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1987,7 +1987,7 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         if (err != 0) {
                 printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
                        err);
-                goto failed_hw;
+                goto failed_bind;
         }
 
         skb_queue_head_init(&data->pending);
@@ -2183,6 +2183,8 @@ static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
         return idx;
 
 failed_hw:
+        device_release_driver(data->dev);
+failed_bind:
         device_unregister(data->dev);
 failed_drvdata:
         ieee80211_free_hw(hw);
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.c b/drivers/net/wireless/mwifiex/11n_rxreorder.c
index 40057079ffb9..5ef5a0eeba50 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.c
@@ -196,6 +196,7 @@ mwifiex_del_rx_reorder_entry(struct mwifiex_private *priv,
         mwifiex_11n_dispatch_pkt_until_start_win(priv, tbl, start_win);
 
         del_timer_sync(&tbl->timer_context.timer);
+        tbl->timer_context.timer_is_set = false;
 
         spin_lock_irqsave(&priv->rx_reorder_tbl_lock, flags);
         list_del(&tbl->list);
@@ -297,6 +298,7 @@ mwifiex_flush_data(unsigned long context)
                 (struct reorder_tmr_cnxt *) context;
         int start_win, seq_num;
 
+        ctx->timer_is_set = false;
         seq_num = mwifiex_11n_find_last_seq_num(ctx);
 
         if (seq_num < 0)
@@ -385,6 +387,7 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
 
         new_node->timer_context.ptr = new_node;
         new_node->timer_context.priv = priv;
+        new_node->timer_context.timer_is_set = false;
 
         init_timer(&new_node->timer_context.timer);
         new_node->timer_context.timer.function = mwifiex_flush_data;
@@ -399,6 +402,22 @@ mwifiex_11n_create_rx_reorder_tbl(struct mwifiex_private *priv, u8 *ta,
         spin_unlock_irqrestore(&priv->rx_reorder_tbl_lock, flags);
 }
 
+static void
+mwifiex_11n_rxreorder_timer_restart(struct mwifiex_rx_reorder_tbl *tbl)
+{
+        u32 min_flush_time;
+
+        if (tbl->win_size >= MWIFIEX_BA_WIN_SIZE_32)
+                min_flush_time = MIN_FLUSH_TIMER_15_MS;
+        else
+                min_flush_time = MIN_FLUSH_TIMER_MS;
+
+        mod_timer(&tbl->timer_context.timer,
+                  jiffies + msecs_to_jiffies(min_flush_time * tbl->win_size));
+
+        tbl->timer_context.timer_is_set = true;
+}
+
 /*
  * This function prepares command for adding a BA request.
  *
@@ -523,31 +542,31 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                                 u8 *ta, u8 pkt_type, void *payload)
 {
         struct mwifiex_rx_reorder_tbl *tbl;
-        int start_win, end_win, win_size;
+        int prev_start_win, start_win, end_win, win_size;
         u16 pkt_index;
         bool init_window_shift = false;
+        int ret = 0;
 
         tbl = mwifiex_11n_get_rx_reorder_tbl(priv, tid, ta);
         if (!tbl) {
                 if (pkt_type != PKT_TYPE_BAR)
                         mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         if ((pkt_type == PKT_TYPE_AMSDU) && !tbl->amsdu) {
                 mwifiex_11n_dispatch_pkt(priv, payload);
-                return 0;
+                return ret;
         }
 
         start_win = tbl->start_win;
+        prev_start_win = start_win;
         win_size = tbl->win_size;
         end_win = ((start_win + win_size) - 1) & (MAX_TID_VALUE - 1);
         if (tbl->flags & RXREOR_INIT_WINDOW_SHIFT) {
                 init_window_shift = true;
                 tbl->flags &= ~RXREOR_INIT_WINDOW_SHIFT;
         }
-        mod_timer(&tbl->timer_context.timer,
-                  jiffies + msecs_to_jiffies(MIN_FLUSH_TIMER_MS * win_size));
 
         if (tbl->flags & RXREOR_FORCE_NO_DROP) {
                 dev_dbg(priv->adapter->dev,
@@ -568,11 +587,14 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 if ((start_win + TWOPOW11) > (MAX_TID_VALUE - 1)) {
                         if (seq_num >= ((start_win + TWOPOW11) &
                                         (MAX_TID_VALUE - 1)) &&
-                            seq_num < start_win)
-                                return -1;
+                            seq_num < start_win) {
+                                ret = -1;
+                                goto done;
+                        }
                 } else if ((seq_num < start_win) ||
-                           (seq_num > (start_win + TWOPOW11))) {
-                        return -1;
+                           (seq_num >= (start_win + TWOPOW11))) {
+                        ret = -1;
+                        goto done;
                 }
         }
 
@@ -601,8 +623,10 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
                 else
                         pkt_index = (seq_num+MAX_TID_VALUE) - start_win;
 
-                if (tbl->rx_reorder_ptr[pkt_index])
-                        return -1;
+                if (tbl->rx_reorder_ptr[pkt_index]) {
+                        ret = -1;
+                        goto done;
+                }
 
                 tbl->rx_reorder_ptr[pkt_index] = payload;
         }
@@ -613,7 +637,11 @@ int mwifiex_11n_rx_reorder_pkt(struct mwifiex_private *priv,
          */
         mwifiex_11n_scan_and_dispatch(priv, tbl);
 
-        return 0;
+done:
+        if (!tbl->timer_context.timer_is_set ||
+            prev_start_win != tbl->start_win)
+                mwifiex_11n_rxreorder_timer_restart(tbl);
+        return ret;
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/11n_rxreorder.h b/drivers/net/wireless/mwifiex/11n_rxreorder.h
index 3a87bb0e3a62..63ecea89b4ab 100644
--- a/drivers/net/wireless/mwifiex/11n_rxreorder.h
+++ b/drivers/net/wireless/mwifiex/11n_rxreorder.h
@@ -21,6 +21,8 @@
 #define _MWIFIEX_11N_RXREORDER_H_
 
 #define MIN_FLUSH_TIMER_MS              50
+#define MIN_FLUSH_TIMER_15_MS           15
+#define MWIFIEX_BA_WIN_SIZE_32          32
 
 #define PKT_TYPE_BAR 0xE7
 #define MAX_TID_VALUE                   (2 << 11)
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index e2635747d966..f55658d15c60 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -592,6 +592,7 @@ struct reorder_tmr_cnxt {
         struct timer_list timer;
         struct mwifiex_rx_reorder_tbl *ptr;
         struct mwifiex_private *priv;
+        u8 timer_is_set;
 };
 
 struct mwifiex_rx_reorder_tbl {
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 573897b8e878..8444313eabe2 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -1111,6 +1111,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Ovislink */
         { USB_DEVICE(0x1b75, 0x3071) },
         { USB_DEVICE(0x1b75, 0x3072) },
+        { USB_DEVICE(0x1b75, 0xa200) },
         /* Para */
         { USB_DEVICE(0x20b8, 0x8888) },
         /* Pegatron */
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 8e68f87ab13c..66ff36447b94 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -158,55 +158,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
         skb_trim(skb, frame_length);
 }
 
-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
+/*
+ * H/W needs L2 padding between the header and the paylod if header size
+ * is not 4 bytes aligned.
+ */
+void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        unsigned int payload_length = skb->len - header_length;
-        unsigned int header_align = ALIGN_SIZE(skb, 0);
-        unsigned int payload_align = ALIGN_SIZE(skb, header_length);
-        unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
-        /*
-         * Adjust the header alignment if the payload needs to be moved more
-         * than the header.
-         */
-        if (payload_align > header_align)
-                header_align += 4;
-
-        /* There is nothing to do if no alignment is needed */
-        if (!header_align)
+        if (!l2pad)
                 return;
 
-        /* Reserve the amount of space needed in front of the frame */
-        skb_push(skb, header_align);
-
-        /*
-         * Move the header.
-         */
-        memmove(skb->data, skb->data + header_align, header_length);
-
-        /* Move the payload, if present and if required */
-        if (payload_length && payload_align)
-                memmove(skb->data + header_length + l2pad,
-                        skb->data + header_length + l2pad + payload_align,
-                        payload_length);
-
-        /* Trim the skb to the correct size */
-        skb_trim(skb, header_length + l2pad + payload_length);
+        skb_push(skb, l2pad);
+        memmove(skb->data, skb->data + l2pad, hdr_len);
 }
 
-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
+void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
 {
-        /*
-         * L2 padding is only present if the skb contains more than just the
-         * IEEE 802.11 header.
-         */
-        unsigned int l2pad = (skb->len > header_length) ?
-                                L2PAD_SIZE(header_length) : 0;
+        unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
 
         if (!l2pad)
                 return;
 
-        memmove(skb->data + l2pad, skb->data, header_length);
+        memmove(skb->data + l2pad, skb->data, hdr_len);
         skb_pull(skb, l2pad);
 }
 
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 58ba71830886..40b6d1d006d7 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -467,7 +467,7 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw)
                     rtl_easy_concurrent_retrytimer_callback, (unsigned long)hw);
         /* <2> work queue */
         rtlpriv->works.hw = hw;
-        rtlpriv->works.rtl_wq = alloc_workqueue(rtlpriv->cfg->name, 0, 0);
+        rtlpriv->works.rtl_wq = alloc_workqueue("%s", 0, 0, rtlpriv->cfg->name);
         INIT_DELAYED_WORK(&rtlpriv->works.watchdog_wq,
                           (void *)rtl_watchdog_wq_callback);
         INIT_DELAYED_WORK(&rtlpriv->works.ips_nic_off_wq,
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index f6179bc06086..07dae0d44abc 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -1828,3 +1828,9 @@ const struct ieee80211_ops rtl_ops = {
         .flush = rtl_op_flush,
 };
 EXPORT_SYMBOL_GPL(rtl_ops);
+
+bool rtl_btc_status_false(void)
+{
+        return false;
+}
+EXPORT_SYMBOL_GPL(rtl_btc_status_false);
diff --git a/drivers/net/wireless/rtlwifi/core.h b/drivers/net/wireless/rtlwifi/core.h
index 59cd3b9dca25..624e1dc16d31 100644
--- a/drivers/net/wireless/rtlwifi/core.h
+++ b/drivers/net/wireless/rtlwifi/core.h
@@ -42,5 +42,6 @@ void rtl_rfreg_delay(struct ieee80211_hw *hw, enum radio_path rfpath, u32 addr,
                      u32 mask, u32 data);
 void rtl_bb_delay(struct ieee80211_hw *hw, u32 addr, u32 data);
 bool rtl_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb);
+bool rtl_btc_status_false(void);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 667aba81246c..61f5d36eca6a 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -842,7 +842,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
                         break;
                 }
                 /* handle command packet here */
-                if (rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
+                if (rtlpriv->cfg->ops->rx_command_packet &&
+                    rtlpriv->cfg->ops->rx_command_packet(hw, stats, skb)) {
                                 dev_kfree_skb_any(skb);
                                 goto end;
                 }
@@ -1127,9 +1128,14 @@ static void _rtl_pci_prepare_bcn_tasklet(struct ieee80211_hw *hw)
 
         __skb_queue_tail(&ring->queue, pskb);
 
-        rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
-                                    &temp_one);
-
+        if (rtlpriv->use_new_trx_flow) {
+                temp_one = 4;
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pbuffer_desc, true,
+                                            HW_DESC_OWN, (u8 *)&temp_one);
+        } else {
+                rtlpriv->cfg->ops->set_desc(hw, (u8 *)pdesc, true, HW_DESC_OWN,
+                                            &temp_one);
+        }
         return;
 }
 
@@ -1370,9 +1376,9 @@ static void _rtl_pci_free_tx_ring(struct ieee80211_hw *hw,
         ring->desc = NULL;
         if (rtlpriv->use_new_trx_flow) {
                 pci_free_consistent(rtlpci->pdev,
-                                    sizeof(*ring->desc) * ring->entries,
+                                    sizeof(*ring->buffer_desc) * ring->entries,
                                     ring->buffer_desc, ring->buffer_desc_dma);
-                ring->desc = NULL;
+                ring->buffer_desc = NULL;
         }
 }
 
@@ -1543,7 +1549,6 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw)
                                                          true,
                                                          HW_DESC_TXBUFF_ADDR),
                                                  skb->len, PCI_DMA_TODEVICE);
-                                ring->idx = (ring->idx + 1) % ring->entries;
                                 kfree_skb(skb);
                                 ring->idx = (ring->idx + 1) % ring->entries;
                         }
@@ -1796,7 +1801,8 @@ static int rtl_pci_start(struct ieee80211_hw *hw)
         rtl_pci_reset_trx_ring(hw);
 
         rtlpci->driver_is_goingto_unload = false;
-        if (rtlpriv->cfg->ops->get_btc_status()) {
+        if (rtlpriv->cfg->ops->get_btc_status &&
+            rtlpriv->cfg->ops->get_btc_status()) {
                 rtlpriv->btcoexist.btc_ops->btc_init_variables(rtlpriv);
                 rtlpriv->btcoexist.btc_ops->btc_init_hal_vars(rtlpriv);
         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
index a00861b26ece..29983bc96a89 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -656,7 +656,8 @@ static u8 reserved_page_packet[TOTAL_RESERVED_PKT_LEN] = {
         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
+void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *))
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
@@ -722,7 +723,10 @@ void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished)
         memcpy((u8 *)skb_put(skb, totalpacketlen),
                &reserved_page_packet, totalpacketlen);
 
-        rtstatus = rtl_cmd_send_packet(hw, skb);
+        if (cmd_send_packet)
+                rtstatus = cmd_send_packet(hw, skb);
+        else
+                rtstatus = rtl_cmd_send_packet(hw, skb);
 
         if (rtstatus)
                 b_dlok = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
index a815bd6273da..b64ae45dc674 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.h
@@ -109,7 +109,9 @@ void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw, u8 element_id,
                          u32 cmd_len, u8 *p_cmdbuffer);
 void rtl92c_firmware_selfreset(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished);
+void rtl92c_set_fw_rsvdpagepkt
+        (struct ieee80211_hw *hw,
+         bool (*cmd_send_packet)(struct ieee80211_hw *, struct sk_buff *));
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void usb_writeN_async(struct rtl_priv *rtlpriv, u32 addr, void *data, u16 len);
 void rtl92c_set_p2p_ps_offload_cmd(struct ieee80211_hw *hw, u8 p2p_ps_state);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
index 831df101d7b7..9b660df6fd71 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/def.h
@@ -114,6 +114,8 @@
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 16, 4)
 #define GET_C2H_CMD_FEEDBACK_CCX_SEQ(__pcmdfbhdr)       \
         LE_BITS_TO_4BYTE(((__pcmdfbhdr) + 4), 20, 12)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define CHIP_VER_B                      BIT(4)
 #define CHIP_BONDING_IDENTIFIER(_value) (((_value) >> 22) & 0x3)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
index 8ec0f031f48a..55357d69397a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/hw.c
@@ -459,7 +459,7 @@ void rtl92ce_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
 
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw, NULL);
 
                                 _rtl92ce_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92ce_set_bcn_ctrl_reg(hw, 0, BIT(4));
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
index d86b5b566444..46ea07605eb4 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/sw.c
@@ -244,6 +244,7 @@ static struct rtl_hal_ops rtl8192ce_hal_ops = {
         .phy_lc_calibrate = _rtl92ce_phy_lc_calibrate,
         .phy_set_bw_mode_callback = rtl92ce_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92ce_dm_dynamic_txpower,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92ce_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
index 2fb9c7acb76a..dc3d20b17a26 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ce/trx.c
@@ -728,6 +728,9 @@ u32 rtl92ce_get_desc(u8 *p_desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_DESC_PKT_LEN(pdesc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(pdesc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 04aa0b5f5b3d..873363acbacf 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1592,6 +1592,20 @@ void rtl92cu_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
         }
 }
 
+bool usb_cmd_send_packet(struct ieee80211_hw *hw, struct sk_buff *skb)
+{
+  /* Currently nothing happens here.
+   * Traffic stops after some seconds in WPA2 802.11n mode.
+   * Maybe because rtl8192cu chip should be set from here?
+   * If I understand correctly, the realtek vendor driver sends some urbs
+   * if its "here".
+   *
+   * This is maybe necessary:
+   * rtlpriv->cfg->ops->fill_tx_cmddesc(hw, buffer, 1, 1, skb);
+   */
+        return true;
+}
+
 void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -1939,7 +1953,8 @@ void rtl92cu_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                         recover = true;
                                 rtl_write_byte(rtlpriv, REG_FWHW_TXQ_CTRL + 2,
                                                tmp_reg422 & (~BIT(6)));
-                                rtl92c_set_fw_rsvdpagepkt(hw, 0);
+                                rtl92c_set_fw_rsvdpagepkt(hw,
+                                                          &usb_cmd_send_packet);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, BIT(3), 0);
                                 _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
                                 if (recover)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
index 0f7812e0c8aa..c1e33b0228c0 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.h
@@ -104,7 +104,6 @@ bool rtl92cu_gpio_radio_on_off_checking(struct ieee80211_hw *hw, u8 * valid);
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid);
 int rtl92c_download_fw(struct ieee80211_hw *hw);
 void rtl92c_set_fw_pwrmode_cmd(struct ieee80211_hw *hw, u8 mode);
-void rtl92c_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool dl_finished);
 void rtl92c_set_fw_joinbss_report_cmd(struct ieee80211_hw *hw, u8 mstatus);
 void rtl92c_fill_h2c_cmd(struct ieee80211_hw *hw,
                          u8 element_id, u32 cmd_len, u8 *p_cmdbuffer);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 7c5fbaf5fee0..e06bafee37f9 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -101,6 +101,12 @@ static void rtl92cu_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+/* get bt coexist status */
+static bool rtl92cu_get_btc_status(void)
+{
+        return false;
+}
+
 static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .init_sw_vars = rtl92cu_init_sw_vars,
         .deinit_sw_vars = rtl92cu_deinit_sw_vars,
@@ -148,6 +154,7 @@ static struct rtl_hal_ops rtl8192cu_hal_ops = {
         .phy_set_bw_mode_callback = rtl92cu_phy_set_bw_mode_callback,
         .dm_dynamic_txpower = rtl92cu_dm_dynamic_txpower,
         .fill_h2c_cmd = rtl92c_fill_h2c_cmd,
+        .get_btc_status = rtl92cu_get_btc_status,
 };
 
 static struct rtl_mod_params rtl92cu_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
index edab5a5351b5..a0aba088259a 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/sw.c
@@ -251,6 +251,7 @@ static struct rtl_hal_ops rtl8192de_hal_ops = {
         .get_rfreg = rtl92d_phy_query_rf_reg,
         .set_rfreg = rtl92d_phy_set_rf_reg,
         .linked_set_reg = rtl92d_linked_set_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92de_mod_params = {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
index dfdc9b20e4ad..1a87edca2c3f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
@@ -362,7 +362,7 @@ void rtl92ee_get_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -591,7 +591,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                                 acm_ctrl &= (~ACMHW_BEQEN);
                                 break;
                         default:
-                                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                          "switch case not process\n");
                                 break;
                         }
@@ -710,7 +710,7 @@ void rtl92ee_set_hw_reg(struct ieee80211_hw *hw, u8 variable, u8 *val)
                 }
                 break;
         default:
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                          "switch case not process %x\n", variable);
                 break;
         }
@@ -2424,7 +2424,7 @@ void rtl92ee_set_key(struct ieee80211_hw *hw, u32 key_index,
                         enc_algo = CAM_AES;
                         break;
                 default:
-                        RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                        RT_TRACE(rtlpriv, COMP_ERR, DBG_DMESG,
                                  "switch case not process\n");
                         enc_algo = CAM_TKIP;
                         break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/def.h b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
index 83c98674bfd3..6e7a70b43949 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/def.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/def.h
@@ -446,6 +446,8 @@
 /* DWORD 6 */
 #define SET_RX_STATUS__DESC_BUFF_ADDR(__pdesc, __val)   \
         SET_BITS_OFFSET_LE(__pdesc + 24, 0, 32, __val)
+#define GET_RX_STATUS_DESC_BUFF_ADDR(__pdesc)                   \
+        SHIFT_AND_MASK_LE(__pdesc + 24, 0, 32)
 
 #define SE_RX_HAL_IS_CCK_RATE(_pdesc)\
         (GET_RX_STATUS_DESC_RX_MCS(_pdesc) == DESC92_RATE1M ||  \
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
index 00e067044c08..5761d5b49e39 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/hw.c
@@ -1201,6 +1201,9 @@ static int _rtl92se_set_media_status(struct ieee80211_hw *hw,
 
         }
 
+        if (type != NL80211_IFTYPE_AP &&
+            rtlpriv->mac80211.link_state < MAC80211_LINKED)
+                bt_msr = rtl_read_byte(rtlpriv, MSR) & ~MSR_LINK_MASK;
         rtl_write_byte(rtlpriv, (MSR), bt_msr);
 
         temp = rtl_read_dword(rtlpriv, TCR);
@@ -1262,6 +1265,7 @@ void rtl92se_enable_interrupt(struct ieee80211_hw *hw)
         rtl_write_dword(rtlpriv, INTA_MASK, rtlpci->irq_mask[0]);
         /* Support Bit 32-37(Assign as Bit 0-5) interrupt setting now */
         rtl_write_dword(rtlpriv, INTA_MASK + 4, rtlpci->irq_mask[1] & 0x3F);
+        rtlpci->irq_enabled = true;
 }
 
 void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
@@ -1276,8 +1280,7 @@ void rtl92se_disable_interrupt(struct ieee80211_hw *hw)
         rtlpci = rtl_pcidev(rtl_pcipriv(hw));
         rtl_write_dword(rtlpriv, INTA_MASK, 0);
         rtl_write_dword(rtlpriv, INTA_MASK + 4, 0);
-
-        synchronize_irq(rtlpci->pdev->irq);
+        rtlpci->irq_enabled = false;
 }
 
 static u8 _rtl92s_set_sysclk(struct ieee80211_hw *hw, u8 data)
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
index 77c5b5f35244..4b4612fe2fdb 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/phy.c
@@ -399,6 +399,8 @@ static bool _rtl92s_phy_sw_chnl_step_by_step(struct ieee80211_hw *hw,
                 case 2:
                         currentcmd = &postcommoncmd[*step];
                         break;
+                default:
+                        return true;
                 }
 
                 if (currentcmd->cmdid == CMDID_END) {
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
index 1bff2a0f7600..fb003868bdef 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/sw.c
@@ -87,11 +87,8 @@ static void rtl92s_init_aspm_vars(struct ieee80211_hw *hw)
 static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
 {
         struct ieee80211_hw *hw = context;
-        struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
         struct rt_firmware *pfirmware = NULL;
-        int err;
 
         RT_TRACE(rtlpriv, COMP_ERR, DBG_LOUD,
                          "Firmware callback routine entered!\n");
@@ -112,20 +109,6 @@ static void rtl92se_fw_cb(const struct firmware *firmware, void *context)
         memcpy(pfirmware->sz_fw_tmpbuffer, firmware->data, firmware->size);
         pfirmware->sz_fw_tmpbufferlen = firmware->size;
         release_firmware(firmware);
-
-        err = ieee80211_register_hw(hw);
-        if (err) {
-                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
-                         "Can't register mac80211 hw\n");
-                return;
-        } else {
-                rtlpriv->mac80211.mac80211_registered = 1;
-        }
-        rtlpci->irq_alloc = 1;
-        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
-
-        /*init rfkill */
-        rtl_init_rfkill(hw);
 }
 
 static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
@@ -226,8 +209,8 @@ static int rtl92s_init_sw_vars(struct ieee80211_hw *hw)
         if (!rtlpriv->rtlhal.pfirmware)
                 return 1;
 
-        rtlpriv->max_fw_size = RTL8190_MAX_RAW_FIRMWARE_CODE_SIZE;
-
+        rtlpriv->max_fw_size = RTL8190_MAX_FIRMWARE_CODE_SIZE*2 +
+                               sizeof(struct fw_hdr);
         pr_info("Driver for Realtek RTL8192SE/RTL8191SE\n"
                 "Loading firmware %s\n", rtlpriv->cfg->fw_name);
         /* request fw */
@@ -253,6 +236,19 @@ static void rtl92s_deinit_sw_vars(struct ieee80211_hw *hw)
         }
 }
 
+static bool rtl92se_is_tx_desc_closed(struct ieee80211_hw *hw, u8 hw_queue,
+                                      u16 index)
+{
+        struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
+        struct rtl8192_tx_ring *ring = &rtlpci->tx_ring[hw_queue];
+        u8 *entry = (u8 *)(&ring->desc[ring->idx]);
+        u8 own = (u8)rtl92se_get_desc(entry, true, HW_DESC_OWN);
+
+        if (own)
+                return false;
+        return true;
+}
+
 static struct rtl_hal_ops rtl8192se_hal_ops = {
         .init_sw_vars = rtl92s_init_sw_vars,
         .deinit_sw_vars = rtl92s_deinit_sw_vars,
@@ -286,6 +282,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .led_control = rtl92se_led_control,
         .set_desc = rtl92se_set_desc,
         .get_desc = rtl92se_get_desc,
+        .is_tx_desc_closed = rtl92se_is_tx_desc_closed,
         .tx_polling = rtl92se_tx_polling,
         .enable_hw_sec = rtl92se_enable_hw_security_config,
         .set_key = rtl92se_set_key,
@@ -294,6 +291,7 @@ static struct rtl_hal_ops rtl8192se_hal_ops = {
         .set_bbreg = rtl92s_phy_set_bb_reg,
         .get_rfreg = rtl92s_phy_query_rf_reg,
         .set_rfreg = rtl92s_phy_set_rf_reg,
+        .get_btc_status = rtl_btc_status_false,
 };
 
 static struct rtl_mod_params rtl92se_mod_params = {
@@ -322,6 +320,8 @@ static struct rtl_hal_cfg rtl92se_hal_cfg = {
         .maps[MAC_RCR_ACRC32] = RCR_ACRC32,
         .maps[MAC_RCR_ACF] = RCR_ACF,
         .maps[MAC_RCR_AAP] = RCR_AAP,
+        .maps[MAC_HIMR] = INTA_MASK,
+        .maps[MAC_HIMRE] = INTA_MASK + 4,
 
         .maps[EFUSE_TEST] = REG_EFUSE_TEST,
         .maps[EFUSE_CTRL] = REG_EFUSE_CTRL,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
index b358ebce8942..672fd3b02835 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
@@ -640,6 +640,9 @@ u32 rtl92se_get_desc(u8 *desc, bool istx, u8 desc_name)
                 case HW_DESC_RXPKT_LEN:
                         ret = GET_RX_STATUS_DESC_PKT_LEN(desc);
                         break;
+                case HW_DESC_RXBUFF_ADDR:
+                        ret = GET_RX_STATUS_DESC_BUFF_ADDR(desc);
+                        break;
                 default:
                         RT_ASSERT(false, "ERR rxdesc :%d not process\n",
                                   desc_name);
diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
index 9786313dc62f..1e9570fa874f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/phy.c
@@ -1889,15 +1889,18 @@ static void _rtl8821ae_store_tx_power_by_rate(struct ieee80211_hw *hw,
         struct rtl_phy *rtlphy = &rtlpriv->phy;
         u8 rate_section = _rtl8821ae_get_rate_section_index(regaddr);
 
-        if (band != BAND_ON_2_4G && band != BAND_ON_5G)
+        if (band != BAND_ON_2_4G && band != BAND_ON_5G) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid Band %d\n", band);
-
-        if (rfpath >= MAX_RF_PATH)
+                band = BAND_ON_2_4G;
+        }
+        if (rfpath >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid RfPath %d\n", rfpath);
-
-        if (txnum >= MAX_RF_PATH)
+                rfpath = MAX_RF_PATH - 1;
+        }
+        if (txnum >= MAX_RF_PATH) {
                 RT_TRACE(rtlpriv, COMP_INIT, DBG_WARNING, "Invalid TxNum %d\n", txnum);
-
+                txnum = MAX_RF_PATH - 1;
+        }
         rtlphy->tx_power_by_rate_offset[band][rfpath][txnum][rate_section] = data;
         RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
                  "TxPwrByRateOffset[Band %d][RfPath %d][TxNum %d][RateSection %d] = 0x%x\n",
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 10cf69c4bc42..46ee956d0235 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -1117,7 +1117,18 @@ int rtl_usb_probe(struct usb_interface *intf,
         }
         rtlpriv->cfg->ops->init_sw_leds(hw);
 
+        err = ieee80211_register_hw(hw);
+        if (err) {
+                RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+                         "Can't register mac80211 hw.\n");
+                err = -ENODEV;
+                goto error_out;
+        }
+        rtlpriv->mac80211.mac80211_registered = 1;
+
+        set_bit(RTL_STATUS_INTERFACE_START, &rtlpriv->status);
         return 0;
+
 error_out:
         rtl_deinit_core(hw);
         _rtl_usb_io_handler_release(hw);
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index d4eb8d2e9cb7..083ecc93fe5e 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -176,10 +176,11 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         char rx_irq_name[IRQ_NAME_SIZE]; /* DEVNAME-qN-rx */
         struct xen_netif_rx_back_ring rx;
         struct sk_buff_head rx_queue;
-        RING_IDX rx_last_skb_slots;
-        unsigned long status;
 
-        struct timer_list rx_stalled;
+        unsigned int rx_queue_max;
+        unsigned int rx_queue_len;
+        unsigned long last_rx_time;
+        bool stalled;
 
         struct gnttab_copy grant_copy_op[MAX_GRANT_COPY_OPS];
 
@@ -199,18 +200,14 @@ struct xenvif_queue { /* Per-queue data for xenvif */
         struct xenvif_stats stats;
 };
 
+/* Maximum number of Rx slots a to-guest packet may use, including the
+ * slot needed for GSO meta-data.
+ */
+#define XEN_NETBK_RX_SLOTS_MAX (MAX_SKB_FRAGS + 1)
+
 enum state_bit_shift {
         /* This bit marks that the vif is connected */
         VIF_STATUS_CONNECTED,
-        /* This bit signals the RX thread that queuing was stopped (in
-         * start_xmit), and either the timer fired or an RX interrupt came
-         */
-        QUEUE_STATUS_RX_PURGE_EVENT,
-        /* This bit tells the interrupt handler that this queue was the reason
-         * for the carrier off, so it should kick the thread. Only queues which
-         * brought it down can turn on the carrier.
-         */
-        QUEUE_STATUS_RX_STALLED
 };
 
 struct xenvif {
@@ -228,9 +225,6 @@ struct xenvif {
         u8 ip_csum:1;
         u8 ipv6_csum:1;
 
-        /* Internal feature information. */
-        u8 can_queue:1;     /* can queue packets for receiver? */
-
         /* Is this interface disabled? True when backend discovers
          * frontend is rogue.
          */
@@ -240,6 +234,9 @@ struct xenvif {
         /* Queues */
         struct xenvif_queue *queues;
         unsigned int num_queues; /* active queues, resource allocated */
+        unsigned int stalled_queues;
+
+        spinlock_t lock;
 
 #ifdef CONFIG_DEBUG_FS
         struct dentry *xenvif_dbg_root;
@@ -249,6 +246,14 @@ struct xenvif {
         struct net_device *dev;
 };
 
+struct xenvif_rx_cb {
+        unsigned long expires;
+        int meta_slots_used;
+        bool full_coalesce;
+};
+
+#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb)
+
 static inline struct xenbus_device *xenvif_to_xenbus_device(struct xenvif *vif)
 {
         return to_xenbus_device(vif->dev->dev.parent);
@@ -272,8 +277,6 @@ void xenvif_xenbus_fini(void);
 
 int xenvif_schedulable(struct xenvif *vif);
 
-int xenvif_must_stop_queue(struct xenvif_queue *queue);
-
 int xenvif_queue_stopped(struct xenvif_queue *queue);
 void xenvif_wake_queue(struct xenvif_queue *queue);
 
@@ -296,6 +299,8 @@ void xenvif_kick_thread(struct xenvif_queue *queue);
 
 int xenvif_dealloc_kthread(void *data);
 
+void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb);
+
 /* Determine whether the needed number of slots (req) are available,
  * and set req_event if not.
  */
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index f379689dde30..895fe84011e7 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -43,6 +43,9 @@
 #define XENVIF_QUEUE_LENGTH 32
 #define XENVIF_NAPI_WEIGHT  64
 
+/* Number of bytes allowed on the internal guest Rx queue. */
+#define XENVIF_RX_QUEUE_BYTES (XEN_NETIF_RX_RING_SIZE/2 * PAGE_SIZE)
+
 /* This function is used to set SKBTX_DEV_ZEROCOPY as well as
  * increasing the inflight counter. We need to increase the inflight
  * counter because core driver calls into xenvif_zerocopy_callback
@@ -60,20 +63,11 @@ void xenvif_skb_zerocopy_complete(struct xenvif_queue *queue)
         atomic_dec(&queue->inflight_packets);
 }
 
-static inline void xenvif_stop_queue(struct xenvif_queue *queue)
-{
-        struct net_device *dev = queue->vif->dev;
-
-        if (!queue->vif->can_queue)
-                return;
-
-        netif_tx_stop_queue(netdev_get_tx_queue(dev, queue->id));
-}
-
 int xenvif_schedulable(struct xenvif *vif)
 {
         return netif_running(vif->dev) &&
-                test_bit(VIF_STATUS_CONNECTED, &vif->status);
+                test_bit(VIF_STATUS_CONNECTED, &vif->status) &&
+                !vif->disabled;
 }
 
 static irqreturn_t xenvif_tx_interrupt(int irq, void *dev_id)
@@ -114,16 +108,7 @@ int xenvif_poll(struct napi_struct *napi, int budget)
 static irqreturn_t xenvif_rx_interrupt(int irq, void *dev_id)
 {
         struct xenvif_queue *queue = dev_id;
-        struct netdev_queue *net_queue =
-                netdev_get_tx_queue(queue->vif->dev, queue->id);
 
-        /* QUEUE_STATUS_RX_PURGE_EVENT is only set if either QDisc was off OR
-         * the carrier went down and this queue was previously blocked
-         */
-        if (unlikely(netif_tx_queue_stopped(net_queue) ||
-                     (!netif_carrier_ok(queue->vif->dev) &&
-                      test_bit(QUEUE_STATUS_RX_STALLED, &queue->status))))
-                set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status);
         xenvif_kick_thread(queue);
 
         return IRQ_HANDLED;
@@ -151,24 +136,13 @@ void xenvif_wake_queue(struct xenvif_queue *queue)
         netif_tx_wake_queue(netdev_get_tx_queue(dev, id));
 }
 
-/* Callback to wake the queue's thread and turn the carrier off on timeout */
-static void xenvif_rx_stalled(unsigned long data)
-{
-        struct xenvif_queue *queue = (struct xenvif_queue *)data;
-
-        if (xenvif_queue_stopped(queue)) {
-                set_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status);
-                xenvif_kick_thread(queue);
-        }
-}
-
 static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct xenvif *vif = netdev_priv(dev);
         struct xenvif_queue *queue = NULL;
         unsigned int num_queues = vif->num_queues;
         u16 index;
-        int min_slots_needed;
+        struct xenvif_rx_cb *cb;
 
         BUG_ON(skb->dev != dev);
 
@@ -191,30 +165,10 @@ static int xenvif_start_xmit(struct sk_buff *skb, struct net_device *dev)
             !xenvif_schedulable(vif))
                 goto drop;
 
-        /* At best we'll need one slot for the header and one for each
-         * frag.
-         */
-        min_slots_needed = 1 + skb_shinfo(skb)->nr_frags;
-
-        /* If the skb is GSO then we'll also need an extra slot for the
-         * metadata.
-         */
-        if (skb_is_gso(skb))
-                min_slots_needed++;
+        cb = XENVIF_RX_CB(skb);
+        cb->expires = jiffies + rx_drain_timeout_jiffies;
 
-        /* If the skb can't possibly fit in the remaining slots
-         * then turn off the queue to give the ring a chance to
-         * drain.
-         */
-        if (!xenvif_rx_ring_slots_available(queue, min_slots_needed)) {
-                queue->rx_stalled.function = xenvif_rx_stalled;
-                queue->rx_stalled.data = (unsigned long)queue;
-                xenvif_stop_queue(queue);
-                mod_timer(&queue->rx_stalled,
-                          jiffies + rx_drain_timeout_jiffies);
-        }
-
-        skb_queue_tail(&queue->rx_queue, skb);
+        xenvif_rx_queue_tail(queue, skb);
         xenvif_kick_thread(queue);
 
         return NETDEV_TX_OK;
@@ -465,6 +419,8 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
         vif->queues = NULL;
         vif->num_queues = 0;
 
+        spin_lock_init(&vif->lock);
+
         dev->netdev_ops = &xenvif_netdev_ops;
         dev->hw_features = NETIF_F_SG |
                 NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
@@ -508,6 +464,8 @@ int xenvif_init_queue(struct xenvif_queue *queue)
         init_timer(&queue->credit_timeout);
         queue->credit_window_start = get_jiffies_64();
 
+        queue->rx_queue_max = XENVIF_RX_QUEUE_BYTES;
+
         skb_queue_head_init(&queue->rx_queue);
         skb_queue_head_init(&queue->tx_queue);
 
@@ -539,8 +497,6 @@ int xenvif_init_queue(struct xenvif_queue *queue)
                 queue->grant_tx_handle[i] = NETBACK_INVALID_HANDLE;
         }
 
-        init_timer(&queue->rx_stalled);
-
         return 0;
 }
 
@@ -551,7 +507,6 @@ void xenvif_carrier_on(struct xenvif *vif)
                 dev_set_mtu(vif->dev, ETH_DATA_LEN);
         netdev_update_features(vif->dev);
         set_bit(VIF_STATUS_CONNECTED, &vif->status);
-        netif_carrier_on(vif->dev);
         if (netif_running(vif->dev))
                 xenvif_up(vif);
         rtnl_unlock();
@@ -611,6 +566,8 @@ int xenvif_connect(struct xenvif_queue *queue, unsigned long tx_ring_ref,
                 disable_irq(queue->rx_irq);
         }
 
+        queue->stalled = true;
+
         task = kthread_create(xenvif_kthread_guest_rx,
                               (void *)queue, "%s-guest-rx", queue->name);
         if (IS_ERR(task)) {
@@ -674,7 +631,6 @@ void xenvif_disconnect(struct xenvif *vif)
                 netif_napi_del(&queue->napi);
 
                 if (queue->task) {
-                        del_timer_sync(&queue->rx_stalled);
                         kthread_stop(queue->task);
                         queue->task = NULL;
                 }
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 08f65996534c..6563f0713fc0 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -55,13 +55,20 @@
 bool separate_tx_rx_irq = 1;
 module_param(separate_tx_rx_irq, bool, 0644);
 
-/* When guest ring is filled up, qdisc queues the packets for us, but we have
- * to timeout them, otherwise other guests' packets can get stuck there
+/* The time that packets can stay on the guest Rx internal queue
+ * before they are dropped.
  */
 unsigned int rx_drain_timeout_msecs = 10000;
 module_param(rx_drain_timeout_msecs, uint, 0444);
 unsigned int rx_drain_timeout_jiffies;
 
+/* The length of time before the frontend is considered unresponsive
+ * because it isn't providing Rx slots.
+ */
+static unsigned int rx_stall_timeout_msecs = 60000;
+module_param(rx_stall_timeout_msecs, uint, 0444);
+static unsigned int rx_stall_timeout_jiffies;
+
 unsigned int xenvif_max_queues;
 module_param_named(max_queues, xenvif_max_queues, uint, 0644);
 MODULE_PARM_DESC(max_queues,
@@ -83,7 +90,6 @@ static void make_tx_response(struct xenvif_queue *queue,
                              s8       st);
 
 static inline int tx_work_todo(struct xenvif_queue *queue);
-static inline int rx_work_todo(struct xenvif_queue *queue);
 
 static struct xen_netif_rx_response *make_rx_response(struct xenvif_queue *queue,
                                              u16      id,
@@ -163,6 +169,69 @@ bool xenvif_rx_ring_slots_available(struct xenvif_queue *queue, int needed)
         return false;
 }
 
+void xenvif_rx_queue_tail(struct xenvif_queue *queue, struct sk_buff *skb)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&queue->rx_queue.lock, flags);
+
+        __skb_queue_tail(&queue->rx_queue, skb);
+
+        queue->rx_queue_len += skb->len;
+        if (queue->rx_queue_len > queue->rx_queue_max)
+                netif_tx_stop_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));
+
+        spin_unlock_irqrestore(&queue->rx_queue.lock, flags);
+}
+
+static struct sk_buff *xenvif_rx_dequeue(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+
+        spin_lock_irq(&queue->rx_queue.lock);
+
+        skb = __skb_dequeue(&queue->rx_queue);
+        if (skb)
+                queue->rx_queue_len -= skb->len;
+
+        spin_unlock_irq(&queue->rx_queue.lock);
+
+        return skb;
+}
+
+static void xenvif_rx_queue_maybe_wake(struct xenvif_queue *queue)
+{
+        spin_lock_irq(&queue->rx_queue.lock);
+
+        if (queue->rx_queue_len < queue->rx_queue_max)
+                netif_tx_wake_queue(netdev_get_tx_queue(queue->vif->dev, queue->id));
+
+        spin_unlock_irq(&queue->rx_queue.lock);
+}
+
+
+static void xenvif_rx_queue_purge(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+        while ((skb = xenvif_rx_dequeue(queue)) != NULL)
+                kfree_skb(skb);
+}
+
+static void xenvif_rx_queue_drop_expired(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+
+        for(;;) {
+                skb = skb_peek(&queue->rx_queue);
+                if (!skb)
+                        break;
+                if (time_before(jiffies, XENVIF_RX_CB(skb)->expires))
+                        break;
+                xenvif_rx_dequeue(queue);
+                kfree_skb(skb);
+        }
+}
+
 /*
  * Returns true if we should start a new receive buffer instead of
  * adding 'size' bytes to a buffer which currently contains 'offset'
@@ -237,13 +306,6 @@ static struct xenvif_rx_meta *get_next_rx_buffer(struct xenvif_queue *queue,
         return meta;
 }
 
-struct xenvif_rx_cb {
-        int meta_slots_used;
-        bool full_coalesce;
-};
-
-#define XENVIF_RX_CB(skb) ((struct xenvif_rx_cb *)(skb)->cb)
-
 /*
  * Set up the grant operations for this fragment. If it's a flipping
  * interface, we also set up the unmap request from here.
@@ -587,12 +649,15 @@ static void xenvif_rx_action(struct xenvif_queue *queue)
 
         skb_queue_head_init(&rxq);
 
-        while ((skb = skb_dequeue(&queue->rx_queue)) != NULL) {
+        while (xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX)
+               && (skb = xenvif_rx_dequeue(queue)) != NULL) {
                 RING_IDX max_slots_needed;
                 RING_IDX old_req_cons;
                 RING_IDX ring_slots_used;
                 int i;
 
+                queue->last_rx_time = jiffies;
+
                 /* We need a cheap worse case estimate for the number of
                  * slots we'll use.
                  */
@@ -634,15 +699,6 @@ static void xenvif_rx_action(struct xenvif_queue *queue)
                     skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
                         max_slots_needed++;
 
-                /* If the skb may not fit then bail out now */
-                if (!xenvif_rx_ring_slots_available(queue, max_slots_needed)) {
-                        skb_queue_head(&queue->rx_queue, skb);
-                        need_to_notify = true;
-                        queue->rx_last_skb_slots = max_slots_needed;
-                        break;
-                } else
-                        queue->rx_last_skb_slots = 0;
-
                 old_req_cons = queue->rx.req_cons;
                 XENVIF_RX_CB(skb)->meta_slots_used = xenvif_gop_skb(skb, &npo, queue);
                 ring_slots_used = queue->rx.req_cons - old_req_cons;
@@ -1869,12 +1925,6 @@ void xenvif_idx_unmap(struct xenvif_queue *queue, u16 pending_idx)
         }
 }
 
-static inline int rx_work_todo(struct xenvif_queue *queue)
-{
-        return (!skb_queue_empty(&queue->rx_queue) &&
-               xenvif_rx_ring_slots_available(queue, queue->rx_last_skb_slots));
-}
-
 static inline int tx_work_todo(struct xenvif_queue *queue)
 {
         if (likely(RING_HAS_UNCONSUMED_REQUESTS(&queue->tx)))
@@ -1931,92 +1981,121 @@ err:
         return err;
 }
 
-static void xenvif_start_queue(struct xenvif_queue *queue)
+static void xenvif_queue_carrier_off(struct xenvif_queue *queue)
 {
-        if (xenvif_schedulable(queue->vif))
-                xenvif_wake_queue(queue);
+        struct xenvif *vif = queue->vif;
+
+        queue->stalled = true;
+
+        /* At least one queue has stalled? Disable the carrier. */
+        spin_lock(&vif->lock);
+        if (vif->stalled_queues++ == 0) {
+                netdev_info(vif->dev, "Guest Rx stalled");
+                netif_carrier_off(vif->dev);
+        }
+        spin_unlock(&vif->lock);
 }
 
-/* Only called from the queue's thread, it handles the situation when the guest
- * doesn't post enough requests on the receiving ring.
- * First xenvif_start_xmit disables QDisc and start a timer, and then either the
- * timer fires, or the guest send an interrupt after posting new request. If it
- * is the timer, the carrier is turned off here.
- * */
-static void xenvif_rx_purge_event(struct xenvif_queue *queue)
+static void xenvif_queue_carrier_on(struct xenvif_queue *queue)
 {
-        /* Either the last unsuccesful skb or at least 1 slot should fit */
-        int needed = queue->rx_last_skb_slots ?
-                     queue->rx_last_skb_slots : 1;
+        struct xenvif *vif = queue->vif;
 
-        /* It is assumed that if the guest post new slots after this, the RX
-         * interrupt will set the QUEUE_STATUS_RX_PURGE_EVENT bit and wake up
-         * the thread again
-         */
-        set_bit(QUEUE_STATUS_RX_STALLED, &queue->status);
-        if (!xenvif_rx_ring_slots_available(queue, needed)) {
-                rtnl_lock();
-                if (netif_carrier_ok(queue->vif->dev)) {
-                        /* Timer fired and there are still no slots. Turn off
-                         * everything except the interrupts
-                         */
-                        netif_carrier_off(queue->vif->dev);
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                        if (net_ratelimit())
-                                netdev_err(queue->vif->dev, "Carrier off due to lack of guest response on queue %d\n", queue->id);
-                } else {
-                        /* Probably an another queue already turned the carrier
-                         * off, make sure nothing is stucked in the internal
-                         * queue of this queue
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                }
-                rtnl_unlock();
-        } else if (!netif_carrier_ok(queue->vif->dev)) {
-                unsigned int num_queues = queue->vif->num_queues;
-                unsigned int i;
-                /* The carrier was down, but an interrupt kicked
-                 * the thread again after new requests were
-                 * posted
-                 */
-                clear_bit(QUEUE_STATUS_RX_STALLED,
-                          &queue->status);
-                rtnl_lock();
-                netif_carrier_on(queue->vif->dev);
-                netif_tx_wake_all_queues(queue->vif->dev);
-                rtnl_unlock();
+        queue->last_rx_time = jiffies; /* Reset Rx stall detection. */
+        queue->stalled = false;
 
-                for (i = 0; i < num_queues; i++) {
-                        struct xenvif_queue *temp = &queue->vif->queues[i];
+        /* All queues are ready? Enable the carrier. */
+        spin_lock(&vif->lock);
+        if (--vif->stalled_queues == 0) {
+                netdev_info(vif->dev, "Guest Rx ready");
+                netif_carrier_on(vif->dev);
+        }
+        spin_unlock(&vif->lock);
+}
 
-                        xenvif_napi_schedule_or_enable_events(temp);
-                }
-                if (net_ratelimit())
-                        netdev_err(queue->vif->dev, "Carrier on again\n");
-        } else {
-                /* Queuing were stopped, but the guest posted
-                 * new requests and sent an interrupt
-                 */
-                clear_bit(QUEUE_STATUS_RX_STALLED,
-                          &queue->status);
-                del_timer_sync(&queue->rx_stalled);
-                xenvif_start_queue(queue);
+static bool xenvif_rx_queue_stalled(struct xenvif_queue *queue)
+{
+        RING_IDX prod, cons;
+
+        prod = queue->rx.sring->req_prod;
+        cons = queue->rx.req_cons;
+
+        return !queue->stalled
+                && prod - cons < XEN_NETBK_RX_SLOTS_MAX
+                && time_after(jiffies,
+                              queue->last_rx_time + rx_stall_timeout_jiffies);
+}
+
+static bool xenvif_rx_queue_ready(struct xenvif_queue *queue)
+{
+        RING_IDX prod, cons;
+
+        prod = queue->rx.sring->req_prod;
+        cons = queue->rx.req_cons;
+
+        return queue->stalled
+                && prod - cons >= XEN_NETBK_RX_SLOTS_MAX;
+}
+
+static bool xenvif_have_rx_work(struct xenvif_queue *queue)
+{
+        return (!skb_queue_empty(&queue->rx_queue)
+                && xenvif_rx_ring_slots_available(queue, XEN_NETBK_RX_SLOTS_MAX))
+                || xenvif_rx_queue_stalled(queue)
+                || xenvif_rx_queue_ready(queue)
+                || kthread_should_stop()
+                || queue->vif->disabled;
+}
+
+static long xenvif_rx_queue_timeout(struct xenvif_queue *queue)
+{
+        struct sk_buff *skb;
+        long timeout;
+
+        skb = skb_peek(&queue->rx_queue);
+        if (!skb)
+                return MAX_SCHEDULE_TIMEOUT;
+
+        timeout = XENVIF_RX_CB(skb)->expires - jiffies;
+        return timeout < 0 ? 0 : timeout;
+}
+
+/* Wait until the guest Rx thread has work.
+ *
+ * The timeout needs to be adjusted based on the current head of the
+ * queue (and not just the head at the beginning).  In particular, if
+ * the queue is initially empty an infinite timeout is used and this
+ * needs to be reduced when a skb is queued.
+ *
+ * This cannot be done with wait_event_timeout() because it only
+ * calculates the timeout once.
+ */
+static void xenvif_wait_for_rx_work(struct xenvif_queue *queue)
+{
+        DEFINE_WAIT(wait);
+
+        if (xenvif_have_rx_work(queue))
+                return;
+
+        for (;;) {
+                long ret;
+
+                prepare_to_wait(&queue->wq, &wait, TASK_INTERRUPTIBLE);
+                if (xenvif_have_rx_work(queue))
+                        break;
+                ret = schedule_timeout(xenvif_rx_queue_timeout(queue));
+                if (!ret)
+                        break;
         }
+        finish_wait(&queue->wq, &wait);
 }
 
 int xenvif_kthread_guest_rx(void *data)
 {
         struct xenvif_queue *queue = data;
-        struct sk_buff *skb;
+        struct xenvif *vif = queue->vif;
 
-        while (!kthread_should_stop()) {
-                wait_event_interruptible(queue->wq,
-                                         rx_work_todo(queue) ||
-                                         queue->vif->disabled ||
-                                         test_bit(QUEUE_STATUS_RX_PURGE_EVENT, &queue->status) ||
-                                         kthread_should_stop());
+        for (;;) {
+                xenvif_wait_for_rx_work(queue);
 
                 if (kthread_should_stop())
                         break;
@@ -2028,35 +2107,38 @@ int xenvif_kthread_guest_rx(void *data)
                  * context so we defer it here, if this thread is
                  * associated with queue 0.
                  */
-                if (unlikely(queue->vif->disabled && queue->id == 0)) {
-                        xenvif_carrier_off(queue->vif);
-                } else if (unlikely(queue->vif->disabled)) {
-                        /* kthread_stop() would be called upon this thread soon,
-                         * be a bit proactive
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
-                } else if (unlikely(test_and_clear_bit(QUEUE_STATUS_RX_PURGE_EVENT,
-                                                     &queue->status))) {
-                        xenvif_rx_purge_event(queue);
-                } else if (!netif_carrier_ok(queue->vif->dev)) {
-                        /* Another queue stalled and turned the carrier off, so
-                         * purge the internal queue of queues which were not
-                         * blocked
-                         */
-                        skb_queue_purge(&queue->rx_queue);
-                        queue->rx_last_skb_slots = 0;
+                if (unlikely(vif->disabled && queue->id == 0)) {
+                        xenvif_carrier_off(vif);
+                        xenvif_rx_queue_purge(queue);
+                        continue;
                 }
 
                 if (!skb_queue_empty(&queue->rx_queue))
                         xenvif_rx_action(queue);
 
+                /* If the guest hasn't provided any Rx slots for a
+                 * while it's probably not responsive, drop the
+                 * carrier so packets are dropped earlier.
+                 */
+                if (xenvif_rx_queue_stalled(queue))
+                        xenvif_queue_carrier_off(queue);
+                else if (xenvif_rx_queue_ready(queue))
+                        xenvif_queue_carrier_on(queue);
+
+                /* Queued packets may have foreign pages from other
+                 * domains.  These cannot be queued indefinitely as
+                 * this would starve guests of grant refs and transmit
+                 * slots.
+                 */
+                xenvif_rx_queue_drop_expired(queue);
+
+                xenvif_rx_queue_maybe_wake(queue);
+
                 cond_resched();
         }
 
         /* Bin any remaining skbs */
-        while ((skb = skb_dequeue(&queue->rx_queue)) != NULL)
-                dev_kfree_skb(skb);
+        xenvif_rx_queue_purge(queue);
 
         return 0;
 }
@@ -2113,6 +2195,7 @@ static int __init netback_init(void)
                 goto failed_init;
 
         rx_drain_timeout_jiffies = msecs_to_jiffies(rx_drain_timeout_msecs);
+        rx_stall_timeout_jiffies = msecs_to_jiffies(rx_stall_timeout_msecs);
 
 #ifdef CONFIG_DEBUG_FS
         xen_netback_dbg_root = debugfs_create_dir("xen-netback", NULL);
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 8079c31ac5e6..4e56a27f9689 100644
--- a/drivers/net/xen-netback/xenbus.c
+++ b/drivers/net/xen-netback/xenbus.c
@@ -52,6 +52,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
         struct xenvif_queue *queue = m->private;
         struct xen_netif_tx_back_ring *tx_ring = &queue->tx;
         struct xen_netif_rx_back_ring *rx_ring = &queue->rx;
+        struct netdev_queue *dev_queue;
 
         if (tx_ring->sring) {
                 struct xen_netif_tx_sring *sring = tx_ring->sring;
@@ -112,6 +113,13 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
                    queue->credit_timeout.expires,
                    jiffies);
 
+        dev_queue = netdev_get_tx_queue(queue->vif->dev, queue->id);
+
+        seq_printf(m, "\nRx internal queue: len %u max %u pkts %u %s\n",
+                   queue->rx_queue_len, queue->rx_queue_max,
+                   skb_queue_len(&queue->rx_queue),
+                   netif_tx_queue_stopped(dev_queue) ? "stopped" : "running");
+
         return 0;
 }
 
@@ -703,6 +711,7 @@ static void connect(struct backend_info *be)
         be->vif->queues = vzalloc(requested_num_queues *
                                   sizeof(struct xenvif_queue));
         be->vif->num_queues = requested_num_queues;
+        be->vif->stalled_queues = requested_num_queues;
 
         for (queue_index = 0; queue_index < requested_num_queues; ++queue_index) {
                 queue = &be->vif->queues[queue_index];
@@ -873,15 +882,10 @@ static int read_xenbus_vif_flags(struct backend_info *be)
         if (!rx_copy)
                 return -EOPNOTSUPP;
 
-        if (vif->dev->tx_queue_len != 0) {
-                if (xenbus_scanf(XBT_NIL, dev->otherend,
-                                 "feature-rx-notify", "%d", &val) < 0)
-                        val = 0;
-                if (val)
-                        vif->can_queue = 1;
-                else
-                        /* Must be non-zero for pfifo_fast to work. */
-                        vif->dev->tx_queue_len = 1;
+        if (xenbus_scanf(XBT_NIL, dev->otherend,
+                         "feature-rx-notify", "%d", &val) < 0 || val == 0) {
+                xenbus_dev_fatal(dev, -EINVAL, "feature-rx-notify is mandatory");
+                return -EINVAL;
         }
 
         if (xenbus_scanf(XBT_NIL, dev->otherend, "feature-sg",
diff --git a/drivers/of/address.c b/drivers/of/address.c
index afdb78299f61..06af494184d6 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -450,6 +450,21 @@ static struct of_bus *of_match_bus(struct device_node *np)
         return NULL;
 }
 
+static int of_empty_ranges_quirk(void)
+{
+        if (IS_ENABLED(CONFIG_PPC)) {
+                /* To save cycles, we cache the result */
+                static int quirk_state = -1;
+
+                if (quirk_state < 0)
+                        quirk_state =
+                                of_machine_is_compatible("Power Macintosh") ||
+                                of_machine_is_compatible("MacRISC");
+                return quirk_state;
+        }
+        return false;
+}
+
 static int of_translate_one(struct device_node *parent, struct of_bus *bus,
                             struct of_bus *pbus, __be32 *addr,
                             int na, int ns, int pna, const char *rprop)
@@ -475,12 +490,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
          * This code is only enabled on powerpc. --gcl
          */
         ranges = of_get_property(parent, rprop, &rlen);
-#if !defined(CONFIG_PPC)
-        if (ranges == NULL) {
+        if (ranges == NULL && !of_empty_ranges_quirk()) {
                 pr_err("OF: no ranges; cannot translate\n");
                 return 1;
         }
-#endif /* !defined(CONFIG_PPC) */
         if (ranges == NULL || rlen == 0) {
                 offset = of_read_number(addr, na);
                 memset(addr, 0, pna * 4);
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 2305dc0382bc..3823edf2d012 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1280,52 +1280,6 @@ int of_property_read_string(struct device_node *np, const char *propname,
 EXPORT_SYMBOL_GPL(of_property_read_string);
 
 /**
- * of_property_read_string_index - Find and read a string from a multiple
- * strings property.
- * @np:         device node from which the property value is to be read.
- * @propname:   name of the property to be searched.
- * @index:      index of the string in the list of strings
- * @out_string: pointer to null terminated return string, modified only if
- *              return value is 0.
- *
- * Search for a property in a device tree node and retrieve a null
- * terminated string value (pointer to data, not a copy) in the list of strings
- * contained in that property.
- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
- * property does not have a value, and -EILSEQ if the string is not
- * null-terminated within the length of the property data.
- *
- * The out_string pointer is modified only if a valid string can be decoded.
- */
-int of_property_read_string_index(struct device_node *np, const char *propname,
-                                  int index, const char **output)
-{
-        struct property *prop = of_find_property(np, propname, NULL);
-        int i = 0;
-        size_t l = 0, total = 0;
-        const char *p;
-
-        if (!prop)
-                return -EINVAL;
-        if (!prop->value)
-                return -ENODATA;
-        if (strnlen(prop->value, prop->length) >= prop->length)
-                return -EILSEQ;
-
-        p = prop->value;
-
-        for (i = 0; total < prop->length; total += l, p += l) {
-                l = strlen(p) + 1;
-                if (i++ == index) {
-                        *output = p;
-                        return 0;
-                }
-        }
-        return -ENODATA;
-}
-EXPORT_SYMBOL_GPL(of_property_read_string_index);
-
-/**
  * of_property_match_string() - Find string in a list and return index
  * @np: pointer to node containing string list property
  * @propname: string list property name
@@ -1351,7 +1305,7 @@ int of_property_match_string(struct device_node *np, const char *propname,
         end = p + prop->length;
 
         for (i = 0; p < end; i++, p += l) {
-                l = strlen(p) + 1;
+                l = strnlen(p, end - p) + 1;
                 if (p + l > end)
                         return -EILSEQ;
                 pr_debug("comparing %s with %s\n", string, p);
@@ -1363,39 +1317,41 @@ int of_property_match_string(struct device_node *np, const char *propname,
 EXPORT_SYMBOL_GPL(of_property_match_string);
 
 /**
- * of_property_count_strings - Find and return the number of strings from a
- * multiple strings property.
+ * of_property_read_string_util() - Utility helper for parsing string properties
  * @np:         device node from which the property value is to be read.
  * @propname:   name of the property to be searched.
+ * @out_strs:   output array of string pointers.
+ * @sz:         number of array elements to read.
+ * @skip:       Number of strings to skip over at beginning of list.
  *
- * Search for a property in a device tree node and retrieve the number of null
- * terminated string contain in it. Returns the number of strings on
- * success, -EINVAL if the property does not exist, -ENODATA if property
- * does not have a value, and -EILSEQ if the string is not null-terminated
- * within the length of the property data.
+ * Don't call this function directly. It is a utility helper for the
+ * of_property_read_string*() family of functions.
  */
-int of_property_count_strings(struct device_node *np, const char *propname)
+int of_property_read_string_helper(struct device_node *np, const char *propname,
+                                   const char **out_strs, size_t sz, int skip)
 {
         struct property *prop = of_find_property(np, propname, NULL);
-        int i = 0;
-        size_t l = 0, total = 0;
-        const char *p;
+        int l = 0, i = 0;
+        const char *p, *end;
 
         if (!prop)
                 return -EINVAL;
         if (!prop->value)
                 return -ENODATA;
-        if (strnlen(prop->value, prop->length) >= prop->length)
-                return -EILSEQ;
-
         p = prop->value;
+        end = p + prop->length;
 
-        for (i = 0; total < prop->length; total += l, p += l, i++)
-                l = strlen(p) + 1;
-
-        return i;
+        for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) {
+                l = strnlen(p, end - p) + 1;
+                if (p + l > end)
+                        return -EILSEQ;
+                if (out_strs && i >= skip)
+                        *out_strs++ = p;
+        }
+        i -= skip;
+        return i <= 0 ? -ENODATA : i;
 }
-EXPORT_SYMBOL_GPL(of_property_count_strings);
+EXPORT_SYMBOL_GPL(of_property_read_string_helper);
 
 void of_print_phandle_args(const char *msg, const struct of_phandle_args *args)
 {
diff --git a/drivers/of/dynamic.c b/drivers/of/dynamic.c
index f297891d8529..d4994177dec2 100644
--- a/drivers/of/dynamic.c
+++ b/drivers/of/dynamic.c
@@ -247,7 +247,7 @@ void of_node_release(struct kobject *kobj)
  * @allocflags: Allocation flags (typically pass GFP_KERNEL)
  *
  * Copy a property by dynamically allocating the memory of both the
- * property stucture and the property name & contents. The property's
+ * property structure and the property name & contents. The property's
  * flags have the OF_DYNAMIC bit set so that we can differentiate between
  * dynamically allocated properties and not.
  * Returns the newly allocated property or NULL on out of memory error.
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index d1ffca8b34ea..30e97bcc4f88 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -773,7 +773,7 @@ int __init early_init_dt_scan_chosen_serial(void)
         if (offset < 0)
                 return -ENODEV;
 
-        while (match->compatible) {
+        while (match->compatible[0]) {
                 unsigned long addr;
                 if (fdt_node_check_compatible(fdt, offset, match->compatible)) {
                         match++;
diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
index 59fb12e84e6b..dc566b38645f 100644
--- a/drivers/of/of_reserved_mem.c
+++ b/drivers/of/of_reserved_mem.c
@@ -243,23 +243,27 @@ static inline struct reserved_mem *__find_rmem(struct device_node *node)
  * This function assign memory region pointed by "memory-region" device tree
  * property to the given device.
  */
-void of_reserved_mem_device_init(struct device *dev)
+int of_reserved_mem_device_init(struct device *dev)
 {
         struct reserved_mem *rmem;
         struct device_node *np;
+        int ret;
 
         np = of_parse_phandle(dev->of_node, "memory-region", 0);
         if (!np)
-                return;
+                return -ENODEV;
 
         rmem = __find_rmem(np);
         of_node_put(np);
 
         if (!rmem || !rmem->ops || !rmem->ops->device_init)
-                return;
+                return -EINVAL;
+
+        ret = rmem->ops->device_init(rmem, dev);
+        if (ret == 0)
+                dev_info(dev, "assigned reserved memory node %s\n", rmem->name);
 
-        rmem->ops->device_init(rmem, dev);
-        dev_info(dev, "assigned reserved memory node %s\n", rmem->name);
+        return ret;
 }
 
 /**
diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
index 78001270a598..e2d79afa9dc6 100644
--- a/drivers/of/selftest.c
+++ b/drivers/of/selftest.c
@@ -339,8 +339,9 @@ static void __init of_selftest_parse_phandle_with_args(void)
         selftest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
 }
 
-static void __init of_selftest_property_match_string(void)
+static void __init of_selftest_property_string(void)
 {
+        const char *strings[4];
         struct device_node *np;
         int rc;
 
@@ -357,13 +358,66 @@ static void __init of_selftest_property_match_string(void)
         rc = of_property_match_string(np, "phandle-list-names", "third");
         selftest(rc == 2, "third expected:0 got:%i\n", rc);
         rc = of_property_match_string(np, "phandle-list-names", "fourth");
-        selftest(rc == -ENODATA, "unmatched string; rc=%i", rc);
+        selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
         rc = of_property_match_string(np, "missing-property", "blah");
-        selftest(rc == -EINVAL, "missing property; rc=%i", rc);
+        selftest(rc == -EINVAL, "missing property; rc=%i\n", rc);
         rc = of_property_match_string(np, "empty-property", "blah");
-        selftest(rc == -ENODATA, "empty property; rc=%i", rc);
+        selftest(rc == -ENODATA, "empty property; rc=%i\n", rc);
         rc = of_property_match_string(np, "unterminated-string", "blah");
-        selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc);
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+
+        /* of_property_count_strings() tests */
+        rc = of_property_count_strings(np, "string-property");
+        selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "phandle-list-names");
+        selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "unterminated-string");
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+        rc = of_property_count_strings(np, "unterminated-string-list");
+        selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
+
+        /* of_property_read_string_index() tests */
+        rc = of_property_read_string_index(np, "string-property", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "string-property", 1, strings);
+        selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 1, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "phandle-list-names", 2, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "phandle-list-names", 3, strings);
+        selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "unterminated-string", 0, strings);
+        selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings);
+        selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[0] = NULL;
+        rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */
+        selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
+        strings[1] = NULL;
+
+        /* of_property_read_string_array() tests */
+        rc = of_property_read_string_array(np, "string-property", strings, 4);
+        selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_read_string_array(np, "phandle-list-names", strings, 4);
+        selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
+        rc = of_property_read_string_array(np, "unterminated-string", strings, 4);
+        selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
+        /* -- An incorrectly formed string should cause a failure */
+        rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4);
+        selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
+        /* -- parsing the correctly formed strings should still work: */
+        strings[2] = NULL;
+        rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2);
+        selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc);
+        strings[1] = NULL;
+        rc = of_property_read_string_array(np, "phandle-list-names", strings, 1);
+        selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]);
 }
 
 #define propcmp(p1, p2) (((p1)->length == (p2)->length) && \
@@ -842,10 +896,14 @@ static void selftest_data_remove(void)
                 return;
         }
 
-        while (last_node_index >= 0) {
+        while (last_node_index-- > 0) {
                 if (nodes[last_node_index]) {
                         np = of_find_node_by_path(nodes[last_node_index]->full_name);
-                        if (strcmp(np->full_name, "/aliases") != 0) {
+                        if (np == nodes[last_node_index]) {
+                                if (of_aliases == np) {
+                                        of_node_put(of_aliases);
+                                        of_aliases = NULL;
+                                }
                                 detach_node_and_children(np);
                         } else {
                                 for_each_property_of_node(np, prop) {
@@ -854,7 +912,6 @@ static void selftest_data_remove(void)
                                 }
                         }
                 }
-                last_node_index--;
         }
 }
 
@@ -867,6 +924,8 @@ static int __init of_selftest(void)
         res = selftest_data_add();
         if (res)
                 return res;
+        if (!of_aliases)
+                of_aliases = of_find_node_by_path("/aliases");
 
         np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
         if (!np) {
@@ -881,7 +940,7 @@ static int __init of_selftest(void)
         of_selftest_find_node_by_name();
         of_selftest_dynamic();
         of_selftest_parse_phandle_with_args();
-        of_selftest_property_match_string();
+        of_selftest_property_string();
         of_selftest_property_copy();
         of_selftest_changeset();
         of_selftest_parse_interrupts();
diff --git a/drivers/of/testcase-data/tests-phandle.dtsi b/drivers/of/testcase-data/tests-phandle.dtsi
index ce0fe083d406..5b1527e8a7fb 100644
--- a/drivers/of/testcase-data/tests-phandle.dtsi
+++ b/drivers/of/testcase-data/tests-phandle.dtsi
@@ -39,7 +39,9 @@
                                 phandle-list-bad-args = <&provider2 1 0>,
                                                         <&provider3 0>;
                                 empty-property;
+                                string-property = "foobar";
                                 unterminated-string = [40 41 42 43];
+                                unterminated-string-list = "first", "second", [40 41 42 43];
                         };
                 };
         };
diff --git a/drivers/pci/access.c b/drivers/pci/access.c
index d292d7cb3417..49dd766852ba 100644
--- a/drivers/pci/access.c
+++ b/drivers/pci/access.c
@@ -444,7 +444,7 @@ static inline int pcie_cap_version(const struct pci_dev *dev)
         return pcie_caps_reg(dev) & PCI_EXP_FLAGS_VERS;
 }
 
-static inline bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
+bool pcie_cap_has_lnkctl(const struct pci_dev *dev)
 {
         int type = pci_pcie_type(dev);
 
diff --git a/drivers/pci/host/pci-imx6.c b/drivers/pci/host/pci-imx6.c
index 233fe8a88264..69202d1eb8fb 100644
--- a/drivers/pci/host/pci-imx6.c
+++ b/drivers/pci/host/pci-imx6.c
@@ -275,15 +275,22 @@ static int imx6_pcie_deassert_core_reset(struct pcie_port *pp)
                 goto err_pcie;
         }
 
-        /* allow the clocks to stabilize */
-        usleep_range(200, 500);
-
         /* power up core phy and enable ref clock */
         regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1,
                         IMX6Q_GPR1_PCIE_TEST_PD, 0 << 18);
+        /*
+         * the async reset input need ref clock to sync internally,
+         * when the ref clock comes after reset, internal synced
+         * reset time is too short, cannot meet the requirement.
+         * add one ~10us delay here.
+         */
+        udelay(10);
         regmap_update_bits(imx6_pcie->iomuxc_gpr, IOMUXC_GPR1,
                         IMX6Q_GPR1_PCIE_REF_CLK_EN, 1 << 16);
 
+        /* allow the clocks to stabilize */
+        usleep_range(200, 500);
+
         /* Some boards don't have PCIe reset GPIO. */
         if (gpio_is_valid(imx6_pcie->reset_gpio)) {
                 gpio_set_value(imx6_pcie->reset_gpio, 0);
diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c
index 9ecabfa8c634..2988fe136c1e 100644
--- a/drivers/pci/host/pci-xgene.c
+++ b/drivers/pci/host/pci-xgene.c
@@ -631,10 +631,15 @@ static int xgene_pcie_probe_bridge(struct platform_device *pdev)
         if (ret)
                 return ret;
 
-        bus = pci_scan_root_bus(&pdev->dev, 0, &xgene_pcie_ops, port, &res);
+        bus = pci_create_root_bus(&pdev->dev, 0,
+                                        &xgene_pcie_ops, port, &res);
         if (!bus)
                 return -ENOMEM;
 
+        pci_scan_child_bus(bus);
+        pci_assign_unassigned_bus_resources(bus);
+        pci_bus_add_devices(bus);
+
         platform_set_drvdata(pdev, port);
         return 0;
 }
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 3a5e7e28b874..07aa722bb12c 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -262,13 +262,6 @@ static int pciehp_probe(struct pcie_device *dev)
                 goto err_out_none;
         }
 
-        if (!dev->port->subordinate) {
-                /* Can happen if we run out of bus numbers during probe */
-                dev_err(&dev->device,
-                        "Hotplug bridge without secondary bus, ignoring\n");
-                goto err_out_none;
-        }
-
         ctrl = pcie_init(dev);
         if (!ctrl) {
                 dev_err(&dev->device, "Controller initialization failed\n");
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index 92b6d9ab00e4..2c6643fdc0cf 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -185,7 +185,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
 }
 static DEVICE_ATTR_RO(modalias);
 
-static ssize_t enabled_store(struct device *dev, struct device_attribute *attr,
+static ssize_t enable_store(struct device *dev, struct device_attribute *attr,
                              const char *buf, size_t count)
 {
         struct pci_dev *pdev = to_pci_dev(dev);
@@ -210,7 +210,7 @@ static ssize_t enabled_store(struct device *dev, struct device_attribute *attr,
         return result < 0 ? result : count;
 }
 
-static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
+static ssize_t enable_show(struct device *dev, struct device_attribute *attr,
                             char *buf)
 {
         struct pci_dev *pdev;
@@ -218,7 +218,7 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
         pdev = to_pci_dev(dev);
         return sprintf(buf, "%u\n", atomic_read(&pdev->enable_cnt));
 }
-static DEVICE_ATTR_RW(enabled);
+static DEVICE_ATTR_RW(enable);
 
 #ifdef CONFIG_NUMA
 static ssize_t numa_node_show(struct device *dev, struct device_attribute *attr,
@@ -563,7 +563,7 @@ static struct attribute *pci_dev_attrs[] = {
 #endif
         &dev_attr_dma_mask_bits.attr,
         &dev_attr_consistent_dma_mask_bits.attr,
-        &dev_attr_enabled.attr,
+        &dev_attr_enable.attr,
         &dev_attr_broken_parity_status.attr,
         &dev_attr_msi_bus.attr,
 #if defined(CONFIG_PM_RUNTIME) && defined(CONFIG_ACPI)
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 0601890db22d..4a3902d8e6fe 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -6,6 +6,8 @@
 
 extern const unsigned char pcie_link_speed[];
 
+bool pcie_cap_has_lnkctl(const struct pci_dev *dev);
+
 /* Functions internal to the PCI core code */
 
 int pci_create_sysfs_dev_files(struct pci_dev *pdev);
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 5ed99309c758..c8ca98c2b480 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -407,15 +407,16 @@ static void pci_read_bridge_mmio_pref(struct pci_bus *child)
 {
         struct pci_dev *dev = child->self;
         u16 mem_base_lo, mem_limit_lo;
-        unsigned long base, limit;
+        u64 base64, limit64;
+        dma_addr_t base, limit;
         struct pci_bus_region region;
         struct resource *res;
 
         res = child->resource[2];
         pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo);
         pci_read_config_word(dev, PCI_PREF_MEMORY_LIMIT, &mem_limit_lo);
-        base = ((unsigned long) mem_base_lo & PCI_PREF_RANGE_MASK) << 16;
-        limit = ((unsigned long) mem_limit_lo & PCI_PREF_RANGE_MASK) << 16;
+        base64 = (mem_base_lo & PCI_PREF_RANGE_MASK) << 16;
+        limit64 = (mem_limit_lo & PCI_PREF_RANGE_MASK) << 16;
 
         if ((mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) == PCI_PREF_RANGE_TYPE_64) {
                 u32 mem_base_hi, mem_limit_hi;
@@ -429,17 +430,20 @@ static void pci_read_bridge_mmio_pref(struct pci_bus *child)
                  * this, just assume they are not being used.
                  */
                 if (mem_base_hi <= mem_limit_hi) {
-#if BITS_PER_LONG == 64
-                        base |= ((unsigned long) mem_base_hi) << 32;
-                        limit |= ((unsigned long) mem_limit_hi) << 32;
-#else
-                        if (mem_base_hi || mem_limit_hi) {
-                                dev_err(&dev->dev, "can't handle 64-bit address space for bridge\n");
-                                return;
-                        }
-#endif
+                        base64 |= (u64) mem_base_hi << 32;
+                        limit64 |= (u64) mem_limit_hi << 32;
                 }
         }
+
+        base = (dma_addr_t) base64;
+        limit = (dma_addr_t) limit64;
+
+        if (base != base64) {
+                dev_err(&dev->dev, "can't handle bridge window above 4GB (bus address %#010llx)\n",
+                        (unsigned long long) base64);
+                return;
+        }
+
         if (base <= limit) {
                 res->flags = (mem_base_lo & PCI_PREF_RANGE_TYPE_MASK) |
                                          IORESOURCE_MEM | IORESOURCE_PREFETCH;
@@ -1323,7 +1327,7 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp)
                         ~hpp->pci_exp_devctl_and, hpp->pci_exp_devctl_or);
 
         /* Initialize Link Control Register */
-        if (dev->subordinate)
+        if (pcie_cap_has_lnkctl(dev))
                 pcie_capability_clear_and_set_word(dev, PCI_EXP_LNKCTL,
                         ~hpp->pci_exp_lnkctl_and, hpp->pci_exp_lnkctl_or);
 
diff --git a/drivers/phy/phy-omap-usb2.c b/drivers/phy/phy-omap-usb2.c
index 8c842980834a..f091576b6449 100644
--- a/drivers/phy/phy-omap-usb2.c
+++ b/drivers/phy/phy-omap-usb2.c
@@ -258,14 +258,16 @@ static int omap_usb2_probe(struct platform_device *pdev)
         otg->phy                = &phy->phy;
 
         platform_set_drvdata(pdev, phy);
+        pm_runtime_enable(phy->dev);
 
         generic_phy = devm_phy_create(phy->dev, NULL, &ops, NULL);
-        if (IS_ERR(generic_phy))
+        if (IS_ERR(generic_phy)) {
+                pm_runtime_disable(phy->dev);
                 return PTR_ERR(generic_phy);
+        }
 
         phy_set_drvdata(generic_phy, phy);
 
-        pm_runtime_enable(phy->dev);
         phy_provider = devm_of_phy_provider_register(phy->dev,
                         of_phy_simple_xlate);
         if (IS_ERR(phy_provider)) {
diff --git a/drivers/pinctrl/pinctrl-baytrail.c b/drivers/pinctrl/pinctrl-baytrail.c
index e12e5b07f6d7..9dc38140194b 100644
--- a/drivers/pinctrl/pinctrl-baytrail.c
+++ b/drivers/pinctrl/pinctrl-baytrail.c
@@ -227,10 +227,14 @@ static int byt_irq_type(struct irq_data *d, unsigned type)
         spin_lock_irqsave(&vg->lock, flags);
         value = readl(reg);
 
+        WARN(value & BYT_DIRECT_IRQ_EN,
+                "Bad pad config for io mode, force direct_irq_en bit clearing");
+
         /* For level trigges the BYT_TRIG_POS and BYT_TRIG_NEG bits
          * are used to indicate high and low level triggering
          */
-        value &= ~(BYT_TRIG_POS | BYT_TRIG_NEG | BYT_TRIG_LVL);
+        value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG |
+                   BYT_TRIG_LVL);
 
         switch (type) {
         case IRQ_TYPE_LEVEL_HIGH:
@@ -318,7 +322,7 @@ static int byt_gpio_direction_output(struct gpio_chip *chip,
                 "Potential Error: Setting GPIO with direct_irq_en to output");
 
         reg_val = readl(reg) | BYT_DIR_MASK;
-        reg_val &= ~BYT_OUTPUT_EN;
+        reg_val &= ~(BYT_OUTPUT_EN | BYT_INPUT_EN);
 
         if (value)
                 writel(reg_val | BYT_LEVEL, reg);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 4dcfb7116a04..a2eabe6ff9ad 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -202,6 +202,7 @@ config TC1100_WMI
 config HP_ACCEL
         tristate "HP laptop accelerometer"
         depends on INPUT && ACPI
+        depends on SERIO_I8042
         select SENSORS_LIS3LV02D
         select NEW_LEDS
         select LEDS_CLASS
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 96a0b75c52c9..26c4fd1394da 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -579,6 +579,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] __initconst = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5741"),
                 },
         },
+        {
+                /*
+                 * Note no video_set_backlight_video_vendor, we must use the
+                 * acer interface, as there is no native backlight interface.
+                 */
+                .ident = "Acer KAV80",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
index 3a4951f46065..c1a6cd66af42 100644
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -182,6 +182,15 @@ static const struct dmi_system_id asus_quirks[] = {
         },
         {
                 .callback = dmi_matched,
+                .ident = "ASUSTeK COMPUTER INC. X550VB",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "X550VB"),
+                },
+                .driver_data = &quirk_asus_wapf4,
+        },
+        {
+                .callback = dmi_matched,
                 .ident = "ASUSTeK COMPUTER INC. X55A",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
index 13e14ec1d3d7..6bec745b6b92 100644
--- a/drivers/platform/x86/hp_accel.c
+++ b/drivers/platform/x86/hp_accel.c
@@ -37,6 +37,8 @@
 #include <linux/leds.h>
 #include <linux/atomic.h>
 #include <linux/acpi.h>
+#include <linux/i8042.h>
+#include <linux/serio.h>
 #include "../../misc/lis3lv02d/lis3lv02d.h"
 
 #define DRIVER_NAME     "hp_accel"
@@ -73,6 +75,13 @@ static inline void delayed_sysfs_set(struct led_classdev *led_cdev,
 
 /* HP-specific accelerometer driver ------------------------------------ */
 
+/* e0 25, e0 26, e0 27, e0 28 are scan codes that the accelerometer with acpi id
+ * HPQ6000 sends through the keyboard bus */
+#define ACCEL_1 0x25
+#define ACCEL_2 0x26
+#define ACCEL_3 0x27
+#define ACCEL_4 0x28
+
 /* For automatic insertion of the module */
 static const struct acpi_device_id lis3lv02d_device_ids[] = {
         {"HPQ0004", 0}, /* HP Mobile Data Protection System PNP */
@@ -294,6 +303,35 @@ static void lis3lv02d_enum_resources(struct acpi_device *device)
                 printk(KERN_DEBUG DRIVER_NAME ": Error getting resources\n");
 }
 
+static bool hp_accel_i8042_filter(unsigned char data, unsigned char str,
+                                  struct serio *port)
+{
+        static bool extended;
+
+        if (str & I8042_STR_AUXDATA)
+                return false;
+
+        if (data == 0xe0) {
+                extended = true;
+                return true;
+        } else if (unlikely(extended)) {
+                extended = false;
+
+                switch (data) {
+                case ACCEL_1:
+                case ACCEL_2:
+                case ACCEL_3:
+                case ACCEL_4:
+                        return true;
+                default:
+                        serio_interrupt(port, 0xe0, 0);
+                        return false;
+                }
+        }
+
+        return false;
+}
+
 static int lis3lv02d_add(struct acpi_device *device)
 {
         int ret;
@@ -326,6 +364,11 @@ static int lis3lv02d_add(struct acpi_device *device)
         if (ret)
                 return ret;
 
+        /* filter to remove HPQ6000 accelerometer data
+         * from keyboard bus stream */
+        if (strstr(dev_name(&device->dev), "HPQ6000"))
+                i8042_install_filter(hp_accel_i8042_filter);
+
         INIT_WORK(&hpled_led.work, delayed_set_status_worker);
         ret = led_classdev_register(NULL, &hpled_led.led_classdev);
         if (ret) {
@@ -343,6 +386,7 @@ static int lis3lv02d_remove(struct acpi_device *device)
         if (!device)
                 return -EINVAL;
 
+        i8042_remove_filter(hp_accel_i8042_filter);
         lis3lv02d_joystick_disable(&lis3_dev);
         lis3lv02d_poweroff(&lis3_dev);
 
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 02152de135b5..ed494f37c40f 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -837,6 +837,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Yoga 2"),
                 },
         },
+        {
+                .ident = "Lenovo Yoga 3 Pro 1370",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 3 Pro-1370"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index 5a5966512277..ff765d8e1a09 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -1561,6 +1561,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
         },
         {
          .callback = samsung_dmi_matched,
+         .ident = "NC210",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "NC210/NC110"),
+                DMI_MATCH(DMI_BOARD_NAME, "NC210/NC110"),
+                },
+         .driver_data = &samsung_broken_acpi_video,
+        },
+        {
+         .callback = samsung_dmi_matched,
          .ident = "730U3E/740U3E",
          .matches = {
                 DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index ef3a1904e92f..ab6151f05420 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -240,6 +240,12 @@ static const struct dmi_system_id toshiba_alt_keymap_dmi[] = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "Qosmio X75-A"),
                 },
         },
+        {
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "TECRA A50-A"),
+                },
+        },
         {}
 };
 
diff --git a/drivers/power/ab8500_fg.c b/drivers/power/ab8500_fg.c
index 217da4b2ca86..99a78d365ceb 100644
--- a/drivers/power/ab8500_fg.c
+++ b/drivers/power/ab8500_fg.c
@@ -25,6 +25,7 @@
 #include <linux/slab.h>
 #include <linux/delay.h>
 #include <linux/time.h>
+#include <linux/time64.h>
 #include <linux/of.h>
 #include <linux/completion.h>
 #include <linux/mfd/core.h>
@@ -108,7 +109,7 @@ enum ab8500_fg_calibration_state {
 struct ab8500_fg_avg_cap {
         int avg;
         int samples[NBR_AVG_SAMPLES];
-        __kernel_time_t time_stamps[NBR_AVG_SAMPLES];
+        time64_t time_stamps[NBR_AVG_SAMPLES];
         int pos;
         int nbr_samples;
         int sum;
@@ -386,15 +387,15 @@ static int ab8500_fg_is_low_curr(struct ab8500_fg *di, int curr)
  */
 static int ab8500_fg_add_cap_sample(struct ab8500_fg *di, int sample)
 {
-        struct timespec ts;
+        struct timespec64 ts64;
         struct ab8500_fg_avg_cap *avg = &di->avg_cap;
 
-        getnstimeofday(&ts);
+        getnstimeofday64(&ts64);
 
         do {
                 avg->sum += sample - avg->samples[avg->pos];
                 avg->samples[avg->pos] = sample;
-                avg->time_stamps[avg->pos] = ts.tv_sec;
+                avg->time_stamps[avg->pos] = ts64.tv_sec;
                 avg->pos++;
 
                 if (avg->pos == NBR_AVG_SAMPLES)
@@ -407,7 +408,7 @@ static int ab8500_fg_add_cap_sample(struct ab8500_fg *di, int sample)
                  * Check the time stamp for each sample. If too old,
                  * replace with latest sample
                  */
-        } while (ts.tv_sec - VALID_CAPACITY_SEC > avg->time_stamps[avg->pos]);
+        } while (ts64.tv_sec - VALID_CAPACITY_SEC > avg->time_stamps[avg->pos]);
 
         avg->avg = avg->sum / avg->nbr_samples;
 
@@ -446,14 +447,14 @@ static void ab8500_fg_clear_cap_samples(struct ab8500_fg *di)
 static void ab8500_fg_fill_cap_sample(struct ab8500_fg *di, int sample)
 {
         int i;
-        struct timespec ts;
+        struct timespec64 ts64;
         struct ab8500_fg_avg_cap *avg = &di->avg_cap;
 
-        getnstimeofday(&ts);
+        getnstimeofday64(&ts64);
 
         for (i = 0; i < NBR_AVG_SAMPLES; i++) {
                 avg->samples[i] = sample;
-                avg->time_stamps[i] = ts.tv_sec;
+                avg->time_stamps[i] = ts64.tv_sec;
         }
 
         avg->pos = 0;
diff --git a/drivers/power/bq2415x_charger.c b/drivers/power/bq2415x_charger.c
index e384844a1ae1..1f49986fc605 100644
--- a/drivers/power/bq2415x_charger.c
+++ b/drivers/power/bq2415x_charger.c
@@ -1579,8 +1579,15 @@ static int bq2415x_probe(struct i2c_client *client,
         if (np) {
                 bq->notify_psy = power_supply_get_by_phandle(np, "ti,usb-charger-detection");
 
-                if (!bq->notify_psy)
-                        return -EPROBE_DEFER;
+                if (IS_ERR(bq->notify_psy)) {
+                        dev_info(&client->dev,
+                                "no 'ti,usb-charger-detection' property (err=%ld)\n",
+                                PTR_ERR(bq->notify_psy));
+                        bq->notify_psy = NULL;
+                } else if (!bq->notify_psy) {
+                        ret = -EPROBE_DEFER;
+                        goto error_2;
+                }
         }
         else if (pdata->notify_device)
                 bq->notify_psy = power_supply_get_by_name(pdata->notify_device);
@@ -1602,27 +1609,27 @@ static int bq2415x_probe(struct i2c_client *client,
                 ret = of_property_read_u32(np, "ti,current-limit",
                                 &bq->init_data.current_limit);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,weak-battery-voltage",
                                 &bq->init_data.weak_battery_voltage);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,battery-regulation-voltage",
                                 &bq->init_data.battery_regulation_voltage);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,charge-current",
                                 &bq->init_data.charge_current);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,termination-current",
                                 &bq->init_data.termination_current);
                 if (ret)
-                        return ret;
+                        goto error_2;
                 ret = of_property_read_u32(np, "ti,resistor-sense",
                                 &bq->init_data.resistor_sense);
                 if (ret)
-                        return ret;
+                        goto error_2;
         } else {
                 memcpy(&bq->init_data, pdata, sizeof(bq->init_data));
         }
diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
index 7098a1ce2d3c..ef8094a61f1e 100644
--- a/drivers/power/charger-manager.c
+++ b/drivers/power/charger-manager.c
@@ -97,6 +97,7 @@ static struct charger_global_desc *g_desc; /* init with setup_charger_manager */
 static bool is_batt_present(struct charger_manager *cm)
 {
         union power_supply_propval val;
+        struct power_supply *psy;
         bool present = false;
         int i, ret;
 
@@ -107,16 +108,27 @@ static bool is_batt_present(struct charger_manager *cm)
         case CM_NO_BATTERY:
                 break;
         case CM_FUEL_GAUGE:
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                psy = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!psy)
+                        break;
+
+                ret = psy->get_property(psy,
                                 POWER_SUPPLY_PROP_PRESENT, &val);
                 if (ret == 0 && val.intval)
                         present = true;
                 break;
         case CM_CHARGER_STAT:
-                for (i = 0; cm->charger_stat[i]; i++) {
-                        ret = cm->charger_stat[i]->get_property(
-                                        cm->charger_stat[i],
-                                        POWER_SUPPLY_PROP_PRESENT, &val);
+                for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                        psy = power_supply_get_by_name(
+                                        cm->desc->psy_charger_stat[i]);
+                        if (!psy) {
+                                dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                                continue;
+                        }
+
+                        ret = psy->get_property(psy, POWER_SUPPLY_PROP_PRESENT,
+                                        &val);
                         if (ret == 0 && val.intval) {
                                 present = true;
                                 break;
@@ -139,14 +151,20 @@ static bool is_batt_present(struct charger_manager *cm)
 static bool is_ext_pwr_online(struct charger_manager *cm)
 {
         union power_supply_propval val;
+        struct power_supply *psy;
         bool online = false;
         int i, ret;
 
         /* If at least one of them has one, it's yes. */
-        for (i = 0; cm->charger_stat[i]; i++) {
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_ONLINE, &val);
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
+                if (!psy) {
+                        dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                        continue;
+                }
+
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
                 if (ret == 0 && val.intval) {
                         online = true;
                         break;
@@ -167,12 +185,14 @@ static bool is_ext_pwr_online(struct charger_manager *cm)
 static int get_batt_uV(struct charger_manager *cm, int *uV)
 {
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
         int ret;
 
-        if (!cm->fuel_gauge)
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
                 return -ENODEV;
 
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+        ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_VOLTAGE_NOW, &val);
         if (ret)
                 return ret;
@@ -189,6 +209,7 @@ static bool is_charging(struct charger_manager *cm)
 {
         int i, ret;
         bool charging = false;
+        struct power_supply *psy;
         union power_supply_propval val;
 
         /* If there is no battery, it cannot be charged */
@@ -196,17 +217,22 @@ static bool is_charging(struct charger_manager *cm)
                 return false;
 
         /* If at least one of the charger is charging, return yes */
-        for (i = 0; cm->charger_stat[i]; i++) {
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
                 /* 1. The charger sholuld not be DISABLED */
                 if (cm->emergency_stop)
                         continue;
                 if (!cm->charger_enabled)
                         continue;
 
+                psy = power_supply_get_by_name(cm->desc->psy_charger_stat[i]);
+                if (!psy) {
+                        dev_err(cm->dev, "Cannot find power supply \"%s\"\n",
+                                        cm->desc->psy_charger_stat[i]);
+                        continue;
+                }
+
                 /* 2. The charger should be online (ext-power) */
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_ONLINE, &val);
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_ONLINE, &val);
                 if (ret) {
                         dev_warn(cm->dev, "Cannot read ONLINE value from %s\n",
                                  cm->desc->psy_charger_stat[i]);
@@ -219,9 +245,7 @@ static bool is_charging(struct charger_manager *cm)
                  * 3. The charger should not be FULL, DISCHARGING,
                  * or NOT_CHARGING.
                  */
-                ret = cm->charger_stat[i]->get_property(
-                                cm->charger_stat[i],
-                                POWER_SUPPLY_PROP_STATUS, &val);
+                ret = psy->get_property(psy, POWER_SUPPLY_PROP_STATUS, &val);
                 if (ret) {
                         dev_warn(cm->dev, "Cannot read STATUS value from %s\n",
                                  cm->desc->psy_charger_stat[i]);
@@ -248,6 +272,7 @@ static bool is_full_charged(struct charger_manager *cm)
 {
         struct charger_desc *desc = cm->desc;
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
         int ret = 0;
         int uV;
 
@@ -255,11 +280,15 @@ static bool is_full_charged(struct charger_manager *cm)
         if (!is_batt_present(cm))
                 return false;
 
-        if (cm->fuel_gauge && desc->fullbatt_full_capacity > 0) {
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
+                return false;
+
+        if (desc->fullbatt_full_capacity > 0) {
                 val.intval = 0;
 
                 /* Not full if capacity of fuel gauge isn't full */
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CHARGE_FULL, &val);
                 if (!ret && val.intval > desc->fullbatt_full_capacity)
                         return true;
@@ -273,10 +302,10 @@ static bool is_full_charged(struct charger_manager *cm)
         }
 
         /* Full, if the capacity is more than fullbatt_soc */
-        if (cm->fuel_gauge && desc->fullbatt_soc > 0) {
+        if (desc->fullbatt_soc > 0) {
                 val.intval = 0;
 
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CAPACITY, &val);
                 if (!ret && val.intval >= desc->fullbatt_soc)
                         return true;
@@ -551,6 +580,20 @@ static int check_charging_duration(struct charger_manager *cm)
         return ret;
 }
 
+static int cm_get_battery_temperature_by_psy(struct charger_manager *cm,
+                                        int *temp)
+{
+        struct power_supply *fuel_gauge;
+
+        fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+        if (!fuel_gauge)
+                return -ENODEV;
+
+        return fuel_gauge->get_property(fuel_gauge,
+                                POWER_SUPPLY_PROP_TEMP,
+                                (union power_supply_propval *)temp);
+}
+
 static int cm_get_battery_temperature(struct charger_manager *cm,
                                         int *temp)
 {
@@ -560,15 +603,18 @@ static int cm_get_battery_temperature(struct charger_manager *cm,
                 return -ENODEV;
 
 #ifdef CONFIG_THERMAL
-        ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
-        if (!ret)
-                /* Calibrate temperature unit */
-                *temp /= 100;
-#else
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
-                                POWER_SUPPLY_PROP_TEMP,
-                                (union power_supply_propval *)temp);
+        if (cm->tzd_batt) {
+                ret = thermal_zone_get_temp(cm->tzd_batt, (unsigned long *)temp);
+                if (!ret)
+                        /* Calibrate temperature unit */
+                        *temp /= 100;
+        } else
 #endif
+        {
+                /* if-else continued from CONFIG_THERMAL */
+                ret = cm_get_battery_temperature_by_psy(cm, temp);
+        }
+
         return ret;
 }
 
@@ -827,6 +873,7 @@ static int charger_get_property(struct power_supply *psy,
         struct charger_manager *cm = container_of(psy,
                         struct charger_manager, charger_psy);
         struct charger_desc *desc = cm->desc;
+        struct power_supply *fuel_gauge;
         int ret = 0;
         int uV;
 
@@ -857,14 +904,20 @@ static int charger_get_property(struct power_supply *psy,
                 ret = get_batt_uV(cm, &val->intval);
                 break;
         case POWER_SUPPLY_PROP_CURRENT_NOW:
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!fuel_gauge) {
+                        ret = -ENODEV;
+                        break;
+                }
+                ret = fuel_gauge->get_property(fuel_gauge,
                                 POWER_SUPPLY_PROP_CURRENT_NOW, val);
                 break;
         case POWER_SUPPLY_PROP_TEMP:
         case POWER_SUPPLY_PROP_TEMP_AMBIENT:
                 return cm_get_battery_temperature(cm, &val->intval);
         case POWER_SUPPLY_PROP_CAPACITY:
-                if (!cm->fuel_gauge) {
+                fuel_gauge = power_supply_get_by_name(cm->desc->psy_fuel_gauge);
+                if (!fuel_gauge) {
                         ret = -ENODEV;
                         break;
                 }
@@ -875,7 +928,7 @@ static int charger_get_property(struct power_supply *psy,
                         break;
                 }
 
-                ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                ret = fuel_gauge->get_property(fuel_gauge,
                                         POWER_SUPPLY_PROP_CAPACITY, val);
                 if (ret)
                         break;
@@ -924,7 +977,14 @@ static int charger_get_property(struct power_supply *psy,
                 break;
         case POWER_SUPPLY_PROP_CHARGE_NOW:
                 if (is_charging(cm)) {
-                        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+                        fuel_gauge = power_supply_get_by_name(
+                                        cm->desc->psy_fuel_gauge);
+                        if (!fuel_gauge) {
+                                ret = -ENODEV;
+                                break;
+                        }
+
+                        ret = fuel_gauge->get_property(fuel_gauge,
                                                 POWER_SUPPLY_PROP_CHARGE_NOW,
                                                 val);
                         if (ret) {
@@ -970,6 +1030,7 @@ static struct power_supply psy_default = {
         .properties = default_charger_props,
         .num_properties = ARRAY_SIZE(default_charger_props),
         .get_property = charger_get_property,
+        .no_thermal = true,
 };
 
 /**
@@ -1485,14 +1546,15 @@ err:
         return ret;
 }
 
-static int cm_init_thermal_data(struct charger_manager *cm)
+static int cm_init_thermal_data(struct charger_manager *cm,
+                struct power_supply *fuel_gauge)
 {
         struct charger_desc *desc = cm->desc;
         union power_supply_propval val;
         int ret;
 
         /* Verify whether fuel gauge provides battery temperature */
-        ret = cm->fuel_gauge->get_property(cm->fuel_gauge,
+        ret = fuel_gauge->get_property(fuel_gauge,
                                         POWER_SUPPLY_PROP_TEMP, &val);
 
         if (!ret) {
@@ -1502,8 +1564,6 @@ static int cm_init_thermal_data(struct charger_manager *cm)
                 cm->desc->measure_battery_temp = true;
         }
 #ifdef CONFIG_THERMAL
-        cm->tzd_batt = cm->fuel_gauge->tzd;
-
         if (ret && desc->thermal_zone) {
                 cm->tzd_batt =
                         thermal_zone_get_zone_by_name(desc->thermal_zone);
@@ -1666,6 +1726,7 @@ static int charger_manager_probe(struct platform_device *pdev)
         int ret = 0, i = 0;
         int j = 0;
         union power_supply_propval val;
+        struct power_supply *fuel_gauge;
 
         if (g_desc && !rtc_dev && g_desc->rtc_name) {
                 rtc_dev = rtc_class_open(g_desc->rtc_name);
@@ -1729,23 +1790,20 @@ static int charger_manager_probe(struct platform_device *pdev)
         while (desc->psy_charger_stat[i])
                 i++;
 
-        cm->charger_stat = devm_kzalloc(&pdev->dev,
-                                sizeof(struct power_supply *) * i, GFP_KERNEL);
-        if (!cm->charger_stat)
-                return -ENOMEM;
-
+        /* Check if charger's supplies are present at probe */
         for (i = 0; desc->psy_charger_stat[i]; i++) {
-                cm->charger_stat[i] = power_supply_get_by_name(
-                                        desc->psy_charger_stat[i]);
-                if (!cm->charger_stat[i]) {
+                struct power_supply *psy;
+
+                psy = power_supply_get_by_name(desc->psy_charger_stat[i]);
+                if (!psy) {
                         dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
                                 desc->psy_charger_stat[i]);
                         return -ENODEV;
                 }
         }
 
-        cm->fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
-        if (!cm->fuel_gauge) {
+        fuel_gauge = power_supply_get_by_name(desc->psy_fuel_gauge);
+        if (!fuel_gauge) {
                 dev_err(&pdev->dev, "Cannot find power supply \"%s\"\n",
                         desc->psy_fuel_gauge);
                 return -ENODEV;
@@ -1788,13 +1846,13 @@ static int charger_manager_probe(struct platform_device *pdev)
         cm->charger_psy.num_properties = psy_default.num_properties;
 
         /* Find which optional psy-properties are available */
-        if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
+        if (!fuel_gauge->get_property(fuel_gauge,
                                           POWER_SUPPLY_PROP_CHARGE_NOW, &val)) {
                 cm->charger_psy.properties[cm->charger_psy.num_properties] =
                                 POWER_SUPPLY_PROP_CHARGE_NOW;
                 cm->charger_psy.num_properties++;
         }
-        if (!cm->fuel_gauge->get_property(cm->fuel_gauge,
+        if (!fuel_gauge->get_property(fuel_gauge,
                                           POWER_SUPPLY_PROP_CURRENT_NOW,
                                           &val)) {
                 cm->charger_psy.properties[cm->charger_psy.num_properties] =
@@ -1802,7 +1860,7 @@ static int charger_manager_probe(struct platform_device *pdev)
                 cm->charger_psy.num_properties++;
         }
 
-        ret = cm_init_thermal_data(cm);
+        ret = cm_init_thermal_data(cm, fuel_gauge);
         if (ret) {
                 dev_err(&pdev->dev, "Failed to initialize thermal data\n");
                 cm->desc->measure_battery_temp = false;
@@ -2066,8 +2124,8 @@ static bool find_power_supply(struct charger_manager *cm,
         int i;
         bool found = false;
 
-        for (i = 0; cm->charger_stat[i]; i++) {
-                if (psy == cm->charger_stat[i]) {
+        for (i = 0; cm->desc->psy_charger_stat[i]; i++) {
+                if (!strcmp(psy->name, cm->desc->psy_charger_stat[i])) {
                         found = true;
                         break;
                 }
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 6cb7fe5c022d..694e8cddd5c1 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -417,6 +417,9 @@ static int psy_register_thermal(struct power_supply *psy)
 {
         int i;
 
+        if (psy->no_thermal)
+                return 0;
+
         /* Register battery zone device psy reports temperature */
         for (i = 0; i < psy->num_properties; i++) {
                 if (psy->properties[i] == POWER_SUPPLY_PROP_TEMP) {
diff --git a/drivers/regulator/max1586.c b/drivers/regulator/max1586.c
index 86db310d5304..d2a8c64cae42 100644
--- a/drivers/regulator/max1586.c
+++ b/drivers/regulator/max1586.c
@@ -163,7 +163,7 @@ static int of_get_max1586_platform_data(struct device *dev,
                                  struct max1586_platform_data *pdata)
 {
         struct max1586_subdev_data *sub;
-        struct of_regulator_match rmatch[ARRAY_SIZE(max1586_reg)];
+        struct of_regulator_match rmatch[ARRAY_SIZE(max1586_reg)] = { };
         struct device_node *np = dev->of_node;
         int i, matched;
 
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index ef1af2debbd2..f69320e1738f 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -395,7 +395,7 @@ static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
-        struct of_regulator_match rmatch;
+        struct of_regulator_match rmatch = { };
         unsigned int i;
 
         pmic_np = iodev->dev->of_node;
diff --git a/drivers/regulator/max77693.c b/drivers/regulator/max77693.c
index c67ff05fc1dd..d158f71fa128 100644
--- a/drivers/regulator/max77693.c
+++ b/drivers/regulator/max77693.c
@@ -227,7 +227,7 @@ static int max77693_pmic_probe(struct platform_device *pdev)
         struct max77693_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct max77693_regulator_data *rdata = NULL;
         int num_rdata, i;
-        struct regulator_config config;
+        struct regulator_config config = { };
 
         num_rdata = max77693_pmic_init_rdata(&pdev->dev, &rdata);
         if (!rdata || num_rdata <= 0) {
diff --git a/drivers/regulator/max77802.c b/drivers/regulator/max77802.c
index d89792b084e9..45fa240fe243 100644
--- a/drivers/regulator/max77802.c
+++ b/drivers/regulator/max77802.c
@@ -454,7 +454,7 @@ static int max77802_pmic_dt_parse_pdata(struct platform_device *pdev,
         struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
-        struct of_regulator_match rmatch;
+        struct of_regulator_match rmatch = { };
         unsigned int i;
 
         pmic_np = iodev->dev->of_node;
diff --git a/drivers/regulator/max8660.c b/drivers/regulator/max8660.c
index 2fc411188794..7eee2ca18541 100644
--- a/drivers/regulator/max8660.c
+++ b/drivers/regulator/max8660.c
@@ -335,7 +335,7 @@ static int max8660_pdata_from_dt(struct device *dev,
         int matched, i;
         struct device_node *np;
         struct max8660_subdev_data *sub;
-        struct of_regulator_match rmatch[ARRAY_SIZE(max8660_reg)];
+        struct of_regulator_match rmatch[ARRAY_SIZE(max8660_reg)] = { };
 
         np = of_get_child_by_name(dev->of_node, "regulators");
         if (!np) {
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 7a51814abdc5..5a1d4afa4776 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -211,7 +211,8 @@ struct regulator_init_data *regulator_of_get_init_data(struct device *dev,
                 search = dev->of_node;
 
         if (!search) {
-                dev_err(dev, "Failed to find regulator container node\n");
+                dev_dbg(dev, "Failed to find regulator container node '%s'\n",
+                        desc->regulators_node);
                 return NULL;
         }
 
diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
index e305416d7697..196a5c8838c4 100644
--- a/drivers/regulator/rk808-regulator.c
+++ b/drivers/regulator/rk808-regulator.c
@@ -44,7 +44,7 @@ static const int rk808_buck_config_regs[] = {
 };
 
 static const struct regulator_linear_range rk808_buck_voltage_ranges[] = {
-        REGULATOR_LINEAR_RANGE(700000, 0, 63, 12500),
+        REGULATOR_LINEAR_RANGE(712500, 0, 63, 12500),
 };
 
 static const struct regulator_linear_range rk808_buck4_voltage_ranges[] = {
diff --git a/drivers/regulator/s2mpa01.c b/drivers/regulator/s2mpa01.c
index 4acefa6b462e..7633b9bfbe6e 100644
--- a/drivers/regulator/s2mpa01.c
+++ b/drivers/regulator/s2mpa01.c
@@ -341,7 +341,7 @@ static int s2mpa01_pmic_probe(struct platform_device *pdev)
 {
         struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct sec_platform_data *pdata = dev_get_platdata(iodev->dev);
-        struct of_regulator_match rdata[S2MPA01_REGULATOR_MAX];
+        struct of_regulator_match rdata[S2MPA01_REGULATOR_MAX] = { };
         struct device_node *reg_np = NULL;
         struct regulator_config config = { };
         struct s2mpa01_info *s2mpa01;
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 94ae1798d48a..6dd12ddbabc6 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -1320,7 +1320,7 @@ config RTC_DRV_LPC32XX
 
 config RTC_DRV_PM8XXX
         tristate "Qualcomm PMIC8XXX RTC"
-        depends on MFD_PM8XXX
+        depends on MFD_PM8XXX || MFD_SPMI_PMIC
         help
           If you say yes here you get support for the
           Qualcomm PMIC8XXX RTC.
diff --git a/drivers/rtc/rtc-bq32k.c b/drivers/rtc/rtc-bq32k.c
index 314129e66d6e..92679df6d6e2 100644
--- a/drivers/rtc/rtc-bq32k.c
+++ b/drivers/rtc/rtc-bq32k.c
@@ -160,7 +160,7 @@ static int trickle_charger_of_init(struct device *dev, struct device_node *node)
                         dev_err(dev, "bq32k: diode and resistor mismatch\n");
                         return -EINVAL;
                 }
-                reg = 0x25;
+                reg = 0x45;
                 break;
 
         default:
diff --git a/drivers/rtc/rtc-pm8xxx.c b/drivers/rtc/rtc-pm8xxx.c
index 197699f358c7..5adcf111fc14 100644
--- a/drivers/rtc/rtc-pm8xxx.c
+++ b/drivers/rtc/rtc-pm8xxx.c
@@ -27,21 +27,36 @@
 
 /* RTC_CTRL register bit fields */
 #define PM8xxx_RTC_ENABLE               BIT(7)
-#define PM8xxx_RTC_ALARM_ENABLE         BIT(1)
 #define PM8xxx_RTC_ALARM_CLEAR          BIT(0)
 
 #define NUM_8_BIT_RTC_REGS              0x4
 
 /**
+ * struct pm8xxx_rtc_regs - describe RTC registers per PMIC versions
+ * @ctrl: base address of control register
+ * @write: base address of write register
+ * @read: base address of read register
+ * @alarm_ctrl: base address of alarm control register
+ * @alarm_ctrl2: base address of alarm control2 register
+ * @alarm_rw: base address of alarm read-write register
+ * @alarm_en: alarm enable mask
+ */
+struct pm8xxx_rtc_regs {
+        unsigned int ctrl;
+        unsigned int write;
+        unsigned int read;
+        unsigned int alarm_ctrl;
+        unsigned int alarm_ctrl2;
+        unsigned int alarm_rw;
+        unsigned int alarm_en;
+};
+
+/**
  * struct pm8xxx_rtc -  rtc driver internal structure
  * @rtc:                rtc device for this driver.
  * @regmap:             regmap used to access RTC registers
  * @allow_set_time:     indicates whether writing to the RTC is allowed
  * @rtc_alarm_irq:      rtc alarm irq number.
- * @rtc_base:           address of rtc control register.
- * @rtc_read_base:      base address of read registers.
- * @rtc_write_base:     base address of write registers.
- * @alarm_rw_base:      base address of alarm registers.
  * @ctrl_reg:           rtc control register.
  * @rtc_dev:            device structure.
  * @ctrl_reg_lock:      spinlock protecting access to ctrl_reg.
@@ -51,11 +66,7 @@ struct pm8xxx_rtc {
         struct regmap *regmap;
         bool allow_set_time;
         int rtc_alarm_irq;
-        int rtc_base;
-        int rtc_read_base;
-        int rtc_write_base;
-        int alarm_rw_base;
-        u8 ctrl_reg;
+        const struct pm8xxx_rtc_regs *regs;
         struct device *rtc_dev;
         spinlock_t ctrl_reg_lock;
 };
@@ -71,8 +82,10 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
 {
         int rc, i;
         unsigned long secs, irq_flags;
-        u8 value[NUM_8_BIT_RTC_REGS], alarm_enabled = 0, ctrl_reg;
+        u8 value[NUM_8_BIT_RTC_REGS], alarm_enabled = 0;
+        unsigned int ctrl_reg;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
         if (!rtc_dd->allow_set_time)
                 return -EACCES;
@@ -87,30 +100,30 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
         dev_dbg(dev, "Seconds value to be written to RTC = %lu\n", secs);
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
-        ctrl_reg = rtc_dd->ctrl_reg;
 
-        if (ctrl_reg & PM8xxx_RTC_ALARM_ENABLE) {
+        rc = regmap_read(rtc_dd->regmap, regs->ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
+
+        if (ctrl_reg & regs->alarm_en) {
                 alarm_enabled = 1;
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+                ctrl_reg &= ~regs->alarm_en;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
                 if (rc) {
                         dev_err(dev, "Write to RTC control register failed\n");
                         goto rtc_rw_fail;
                 }
-                rtc_dd->ctrl_reg = ctrl_reg;
-        } else {
-                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
         }
 
         /* Write 0 to Byte[0] */
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_write_base, 0);
+        rc = regmap_write(rtc_dd->regmap, regs->write, 0);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
                 goto rtc_rw_fail;
         }
 
         /* Write Byte[1], Byte[2], Byte[3] */
-        rc = regmap_bulk_write(rtc_dd->regmap, rtc_dd->rtc_write_base + 1,
+        rc = regmap_bulk_write(rtc_dd->regmap, regs->write + 1,
                                &value[1], sizeof(value) - 1);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
@@ -118,25 +131,23 @@ static int pm8xxx_rtc_set_time(struct device *dev, struct rtc_time *tm)
         }
 
         /* Write Byte[0] */
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_write_base, value[0]);
+        rc = regmap_write(rtc_dd->regmap, regs->write, value[0]);
         if (rc) {
                 dev_err(dev, "Write to RTC write data register failed\n");
                 goto rtc_rw_fail;
         }
 
         if (alarm_enabled) {
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+                ctrl_reg |= regs->alarm_en;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
                 if (rc) {
                         dev_err(dev, "Write to RTC control register failed\n");
                         goto rtc_rw_fail;
                 }
-                rtc_dd->ctrl_reg = ctrl_reg;
         }
 
 rtc_rw_fail:
-        if (alarm_enabled)
-                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
+        spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         return rc;
 }
@@ -148,9 +159,9 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
         unsigned long secs;
         unsigned int reg;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
-        rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->rtc_read_base,
-                              value, sizeof(value));
+        rc = regmap_bulk_read(rtc_dd->regmap, regs->read, value, sizeof(value));
         if (rc) {
                 dev_err(dev, "RTC read data register failed\n");
                 return rc;
@@ -160,14 +171,14 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
          * Read the LSB again and check if there has been a carry over.
          * If there is, redo the read operation.
          */
-        rc = regmap_read(rtc_dd->regmap, rtc_dd->rtc_read_base, &reg);
+        rc = regmap_read(rtc_dd->regmap, regs->read, &reg);
         if (rc < 0) {
                 dev_err(dev, "RTC read data register failed\n");
                 return rc;
         }
 
         if (unlikely(reg < value[0])) {
-                rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->rtc_read_base,
+                rc = regmap_bulk_read(rtc_dd->regmap, regs->read,
                                       value, sizeof(value));
                 if (rc) {
                         dev_err(dev, "RTC read data register failed\n");
@@ -195,9 +206,11 @@ static int pm8xxx_rtc_read_time(struct device *dev, struct rtc_time *tm)
 static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 {
         int rc, i;
-        u8 value[NUM_8_BIT_RTC_REGS], ctrl_reg;
+        u8 value[NUM_8_BIT_RTC_REGS];
+        unsigned int ctrl_reg;
         unsigned long secs, irq_flags;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
         rtc_tm_to_time(&alarm->time, &secs);
 
@@ -208,28 +221,28 @@ static int pm8xxx_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *alarm)
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
-        rc = regmap_bulk_write(rtc_dd->regmap, rtc_dd->alarm_rw_base, value,
+        rc = regmap_bulk_write(rtc_dd->regmap, regs->alarm_rw, value,
                                sizeof(value));
         if (rc) {
                 dev_err(dev, "Write to RTC ALARM register failed\n");
                 goto rtc_rw_fail;
         }
 
-        ctrl_reg = rtc_dd->ctrl_reg;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
 
         if (alarm->enabled)
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg |= regs->alarm_en;
         else
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
-                dev_err(dev, "Write to RTC control register failed\n");
+                dev_err(dev, "Write to RTC alarm control register failed\n");
                 goto rtc_rw_fail;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
-
         dev_dbg(dev, "Alarm Set for h:r:s=%d:%d:%d, d/m/y=%d/%d/%d\n",
                 alarm->time.tm_hour, alarm->time.tm_min,
                 alarm->time.tm_sec, alarm->time.tm_mday,
@@ -245,8 +258,9 @@ static int pm8xxx_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alarm)
         u8 value[NUM_8_BIT_RTC_REGS];
         unsigned long secs;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
 
-        rc = regmap_bulk_read(rtc_dd->regmap, rtc_dd->alarm_rw_base, value,
+        rc = regmap_bulk_read(rtc_dd->regmap, regs->alarm_rw, value,
                               sizeof(value));
         if (rc) {
                 dev_err(dev, "RTC alarm time read failed\n");
@@ -276,25 +290,26 @@ static int pm8xxx_rtc_alarm_irq_enable(struct device *dev, unsigned int enable)
         int rc;
         unsigned long irq_flags;
         struct pm8xxx_rtc *rtc_dd = dev_get_drvdata(dev);
-        u8 ctrl_reg;
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+        unsigned int ctrl_reg;
 
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
-        ctrl_reg = rtc_dd->ctrl_reg;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc)
+                goto rtc_rw_fail;
 
         if (enable)
-                ctrl_reg |= PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg |= regs->alarm_en;
         else
-                ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+                ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
                 dev_err(dev, "Write to RTC control register failed\n");
                 goto rtc_rw_fail;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
-
 rtc_rw_fail:
         spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
         return rc;
@@ -311,6 +326,7 @@ static const struct rtc_class_ops pm8xxx_rtc_ops = {
 static irqreturn_t pm8xxx_alarm_trigger(int irq, void *dev_id)
 {
         struct pm8xxx_rtc *rtc_dd = dev_id;
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
         unsigned int ctrl_reg;
         int rc;
         unsigned long irq_flags;
@@ -320,48 +336,100 @@ static irqreturn_t pm8xxx_alarm_trigger(int irq, void *dev_id)
         spin_lock_irqsave(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         /* Clear the alarm enable bit */
-        ctrl_reg = rtc_dd->ctrl_reg;
-        ctrl_reg &= ~PM8xxx_RTC_ALARM_ENABLE;
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl, &ctrl_reg);
+        if (rc) {
+                spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
+                goto rtc_alarm_handled;
+        }
+
+        ctrl_reg &= ~regs->alarm_en;
 
-        rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl, ctrl_reg);
         if (rc) {
                 spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
                 dev_err(rtc_dd->rtc_dev,
-                        "Write to RTC control register failed\n");
+                        "Write to alarm control register failed\n");
                 goto rtc_alarm_handled;
         }
 
-        rtc_dd->ctrl_reg = ctrl_reg;
         spin_unlock_irqrestore(&rtc_dd->ctrl_reg_lock, irq_flags);
 
         /* Clear RTC alarm register */
-        rc = regmap_read(rtc_dd->regmap,
-                         rtc_dd->rtc_base + PM8XXX_ALARM_CTRL_OFFSET,
-                         &ctrl_reg);
+        rc = regmap_read(rtc_dd->regmap, regs->alarm_ctrl2, &ctrl_reg);
         if (rc) {
                 dev_err(rtc_dd->rtc_dev,
-                        "RTC Alarm control register read failed\n");
+                        "RTC Alarm control2 register read failed\n");
                 goto rtc_alarm_handled;
         }
 
-        ctrl_reg &= ~PM8xxx_RTC_ALARM_CLEAR;
-        rc = regmap_write(rtc_dd->regmap,
-                          rtc_dd->rtc_base + PM8XXX_ALARM_CTRL_OFFSET,
-                          ctrl_reg);
+        ctrl_reg |= PM8xxx_RTC_ALARM_CLEAR;
+        rc = regmap_write(rtc_dd->regmap, regs->alarm_ctrl2, ctrl_reg);
         if (rc)
                 dev_err(rtc_dd->rtc_dev,
-                        "Write to RTC Alarm control register failed\n");
+                        "Write to RTC Alarm control2 register failed\n");
 
 rtc_alarm_handled:
         return IRQ_HANDLED;
 }
 
+static int pm8xxx_rtc_enable(struct pm8xxx_rtc *rtc_dd)
+{
+        const struct pm8xxx_rtc_regs *regs = rtc_dd->regs;
+        unsigned int ctrl_reg;
+        int rc;
+
+        /* Check if the RTC is on, else turn it on */
+        rc = regmap_read(rtc_dd->regmap, regs->ctrl, &ctrl_reg);
+        if (rc)
+                return rc;
+
+        if (!(ctrl_reg & PM8xxx_RTC_ENABLE)) {
+                ctrl_reg |= PM8xxx_RTC_ENABLE;
+                rc = regmap_write(rtc_dd->regmap, regs->ctrl, ctrl_reg);
+                if (rc)
+                        return rc;
+        }
+
+        return 0;
+}
+
+static const struct pm8xxx_rtc_regs pm8921_regs = {
+        .ctrl           = 0x11d,
+        .write          = 0x11f,
+        .read           = 0x123,
+        .alarm_rw       = 0x127,
+        .alarm_ctrl     = 0x11d,
+        .alarm_ctrl2    = 0x11e,
+        .alarm_en       = BIT(1),
+};
+
+static const struct pm8xxx_rtc_regs pm8058_regs = {
+        .ctrl           = 0x1e8,
+        .write          = 0x1ea,
+        .read           = 0x1ee,
+        .alarm_rw       = 0x1f2,
+        .alarm_ctrl     = 0x1e8,
+        .alarm_ctrl2    = 0x1e9,
+        .alarm_en       = BIT(1),
+};
+
+static const struct pm8xxx_rtc_regs pm8941_regs = {
+        .ctrl           = 0x6046,
+        .write          = 0x6040,
+        .read           = 0x6048,
+        .alarm_rw       = 0x6140,
+        .alarm_ctrl     = 0x6146,
+        .alarm_ctrl2    = 0x6148,
+        .alarm_en       = BIT(7),
+};
+
 /*
  * Hardcoded RTC bases until IORESOURCE_REG mapping is figured out
  */
 static const struct of_device_id pm8xxx_id_table[] = {
-        { .compatible = "qcom,pm8921-rtc", .data = (void *) 0x11D },
-        { .compatible = "qcom,pm8058-rtc", .data = (void *) 0x1E8 },
+        { .compatible = "qcom,pm8921-rtc", .data = &pm8921_regs },
+        { .compatible = "qcom,pm8058-rtc", .data = &pm8058_regs },
+        { .compatible = "qcom,pm8941-rtc", .data = &pm8941_regs },
         { },
 };
 MODULE_DEVICE_TABLE(of, pm8xxx_id_table);
@@ -369,7 +437,6 @@ MODULE_DEVICE_TABLE(of, pm8xxx_id_table);
 static int pm8xxx_rtc_probe(struct platform_device *pdev)
 {
         int rc;
-        unsigned int ctrl_reg;
         struct pm8xxx_rtc *rtc_dd;
         const struct of_device_id *match;
 
@@ -399,33 +466,12 @@ static int pm8xxx_rtc_probe(struct platform_device *pdev)
         rtc_dd->allow_set_time = of_property_read_bool(pdev->dev.of_node,
                                                       "allow-set-time");
 
-        rtc_dd->rtc_base = (long) match->data;
-
-        /* Setup RTC register addresses */
-        rtc_dd->rtc_write_base = rtc_dd->rtc_base + PM8XXX_RTC_WRITE_OFFSET;
-        rtc_dd->rtc_read_base = rtc_dd->rtc_base + PM8XXX_RTC_READ_OFFSET;
-        rtc_dd->alarm_rw_base = rtc_dd->rtc_base + PM8XXX_ALARM_RW_OFFSET;
-
+        rtc_dd->regs = match->data;
         rtc_dd->rtc_dev = &pdev->dev;
 
-        /* Check if the RTC is on, else turn it on */
-        rc = regmap_read(rtc_dd->regmap, rtc_dd->rtc_base, &ctrl_reg);
-        if (rc) {
-                dev_err(&pdev->dev, "RTC control register read failed!\n");
+        rc = pm8xxx_rtc_enable(rtc_dd);
+        if (rc)
                 return rc;
-        }
-
-        if (!(ctrl_reg & PM8xxx_RTC_ENABLE)) {
-                ctrl_reg |= PM8xxx_RTC_ENABLE;
-                rc = regmap_write(rtc_dd->regmap, rtc_dd->rtc_base, ctrl_reg);
-                if (rc) {
-                        dev_err(&pdev->dev,
-                                "Write to RTC control register failed\n");
-                        return rc;
-                }
-        }
-
-        rtc_dd->ctrl_reg = ctrl_reg;
 
         platform_set_drvdata(pdev, rtc_dd);
 
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index a6b1252c9941..806072238c00 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -535,13 +535,15 @@ static int s3c_rtc_probe(struct platform_device *pdev)
         }
         clk_prepare_enable(info->rtc_clk);
 
-        info->rtc_src_clk = devm_clk_get(&pdev->dev, "rtc_src");
-        if (IS_ERR(info->rtc_src_clk)) {
-                dev_err(&pdev->dev, "failed to find rtc source clock\n");
-                return PTR_ERR(info->rtc_src_clk);
+        if (info->data->needs_src_clk) {
+                info->rtc_src_clk = devm_clk_get(&pdev->dev, "rtc_src");
+                if (IS_ERR(info->rtc_src_clk)) {
+                        dev_err(&pdev->dev,
+                                "failed to find rtc source clock\n");
+                        return PTR_ERR(info->rtc_src_clk);
+                }
+                clk_prepare_enable(info->rtc_src_clk);
         }
-        clk_prepare_enable(info->rtc_src_clk);
-
 
         /* check to see if everything is setup correctly */
         if (info->data->enable)
diff --git a/drivers/s390/kvm/virtio_ccw.c b/drivers/s390/kvm/virtio_ccw.c
index 6cbe6ef3c889..bda52f18e967 100644
--- a/drivers/s390/kvm/virtio_ccw.c
+++ b/drivers/s390/kvm/virtio_ccw.c
@@ -888,7 +888,6 @@ static void virtio_ccw_int_handler(struct ccw_device *cdev,
         struct virtio_ccw_device *vcdev = dev_get_drvdata(&cdev->dev);
         int i;
         struct virtqueue *vq;
-        struct virtio_driver *drv;
 
         if (!vcdev)
                 return;
diff --git a/drivers/scsi/bnx2fc/bnx2fc_els.c b/drivers/scsi/bnx2fc/bnx2fc_els.c
index ca75c7ca2559..ef355c13ccc4 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_els.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_els.c
@@ -480,9 +480,7 @@ void bnx2fc_rec_compl(struct bnx2fc_els_cb_arg *cb_arg)
                         bnx2fc_initiate_cleanup(orig_io_req);
                         /* Post a new IO req with the same sc_cmd */
                         BNX2FC_IO_DBG(rec_req, "Post IO request again\n");
-                        spin_unlock_bh(&tgt->tgt_lock);
                         rc = bnx2fc_post_io_req(tgt, new_io_req);
-                        spin_lock_bh(&tgt->tgt_lock);
                         if (!rc)
                                 goto free_frame;
                         BNX2FC_IO_DBG(rec_req, "REC: io post err\n");
diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c
index 0679782d9d15..5b99844ef6bf 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_io.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_io.c
@@ -1894,18 +1894,24 @@ int bnx2fc_queuecommand(struct Scsi_Host *host,
                         goto exit_qcmd;
                 }
         }
+
+        spin_lock_bh(&tgt->tgt_lock);
+
         io_req = bnx2fc_cmd_alloc(tgt);
         if (!io_req) {
                 rc = SCSI_MLQUEUE_HOST_BUSY;
-                goto exit_qcmd;
+                goto exit_qcmd_tgtlock;
         }
         io_req->sc_cmd = sc_cmd;
 
         if (bnx2fc_post_io_req(tgt, io_req)) {
                 printk(KERN_ERR PFX "Unable to post io_req\n");
                 rc = SCSI_MLQUEUE_HOST_BUSY;
-                goto exit_qcmd;
+                goto exit_qcmd_tgtlock;
         }
+
+exit_qcmd_tgtlock:
+        spin_unlock_bh(&tgt->tgt_lock);
 exit_qcmd:
         return rc;
 }
@@ -2020,6 +2026,8 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         int task_idx, index;
         u16 xid;
 
+        /* bnx2fc_post_io_req() is called with the tgt_lock held */
+
         /* Initialize rest of io_req fields */
         io_req->cmd_type = BNX2FC_SCSI_CMD;
         io_req->port = port;
@@ -2047,9 +2055,7 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         /* Build buffer descriptor list for firmware from sg list */
         if (bnx2fc_build_bd_list_from_sg(io_req)) {
                 printk(KERN_ERR PFX "BD list creation failed\n");
-                spin_lock_bh(&tgt->tgt_lock);
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
@@ -2061,19 +2067,15 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
         task = &(task_page[index]);
         bnx2fc_init_task(io_req, task);
 
-        spin_lock_bh(&tgt->tgt_lock);
-
         if (tgt->flush_in_prog) {
                 printk(KERN_ERR PFX "Flush in progress..Host Busy\n");
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
         if (!test_bit(BNX2FC_FLAG_SESSION_READY, &tgt->flags)) {
                 printk(KERN_ERR PFX "Session not ready...post_io\n");
                 kref_put(&io_req->refcount, bnx2fc_cmd_release);
-                spin_unlock_bh(&tgt->tgt_lock);
                 return -EAGAIN;
         }
 
@@ -2091,6 +2093,5 @@ int bnx2fc_post_io_req(struct bnx2fc_rport *tgt,
 
         /* Ring doorbell */
         bnx2fc_ring_doorbell(tgt);
-        spin_unlock_bh(&tgt->tgt_lock);
         return 0;
 }
diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
index 3e0a0d315f72..15081257cfc8 100644
--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c
@@ -828,6 +828,8 @@ static void do_act_open_rpl(struct cxgbi_device *cdev, struct sk_buff *skb)
         if (status == CPL_ERR_RTX_NEG_ADVICE)
                 goto rel_skb;
 
+        module_put(THIS_MODULE);
+
         if (status && status != CPL_ERR_TCAM_FULL &&
             status != CPL_ERR_CONN_EXIST &&
             status != CPL_ERR_ARP_MISS)
@@ -936,20 +938,23 @@ static void do_abort_req_rss(struct cxgbi_device *cdev, struct sk_buff *skb)
         cxgbi_sock_get(csk);
         spin_lock_bh(&csk->lock);
 
-        if (!cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD)) {
-                cxgbi_sock_set_flag(csk, CTPF_ABORT_REQ_RCVD);
-                cxgbi_sock_set_state(csk, CTP_ABORTING);
-                goto done;
+        cxgbi_sock_clear_flag(csk, CTPF_ABORT_REQ_RCVD);
+
+        if (!cxgbi_sock_flag(csk, CTPF_TX_DATA_SENT)) {
+                send_tx_flowc_wr(csk);
+                cxgbi_sock_set_flag(csk, CTPF_TX_DATA_SENT);
         }
 
-        cxgbi_sock_clear_flag(csk, CTPF_ABORT_REQ_RCVD);
+        cxgbi_sock_set_flag(csk, CTPF_ABORT_REQ_RCVD);
+        cxgbi_sock_set_state(csk, CTP_ABORTING);
+
         send_abort_rpl(csk, rst_status);
 
         if (!cxgbi_sock_flag(csk, CTPF_ABORT_RPL_PENDING)) {
                 csk->err = abort_status_to_errno(csk, req->status, &rst_status);
                 cxgbi_sock_closed(csk);
         }
-done:
+
         spin_unlock_bh(&csk->lock);
         cxgbi_sock_put(csk);
 rel_skb:
diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c
index 54fa6e0bc1bb..7da59c38a69e 100644
--- a/drivers/scsi/cxgbi/libcxgbi.c
+++ b/drivers/scsi/cxgbi/libcxgbi.c
@@ -399,6 +399,35 @@ EXPORT_SYMBOL_GPL(cxgbi_hbas_add);
  *   If the source port is outside our allocation range, the caller is
  *   responsible for keeping track of their port usage.
  */
+
+static struct cxgbi_sock *find_sock_on_port(struct cxgbi_device *cdev,
+                                            unsigned char port_id)
+{
+        struct cxgbi_ports_map *pmap = &cdev->pmap;
+        unsigned int i;
+        unsigned int used;
+
+        if (!pmap->max_connect || !pmap->used)
+                return NULL;
+
+        spin_lock_bh(&pmap->lock);
+        used = pmap->used;
+        for (i = 0; used && i < pmap->max_connect; i++) {
+                struct cxgbi_sock *csk = pmap->port_csk[i];
+
+                if (csk) {
+                        if (csk->port_id == port_id) {
+                                spin_unlock_bh(&pmap->lock);
+                                return csk;
+                        }
+                        used--;
+                }
+        }
+        spin_unlock_bh(&pmap->lock);
+
+        return NULL;
+}
+
 static int sock_get_port(struct cxgbi_sock *csk)
 {
         struct cxgbi_device *cdev = csk->cdev;
@@ -749,6 +778,7 @@ static struct cxgbi_sock *cxgbi_check_route6(struct sockaddr *dst_addr)
         csk->daddr6.sin6_addr = daddr6->sin6_addr;
         csk->daddr6.sin6_port = daddr6->sin6_port;
         csk->daddr6.sin6_family = daddr6->sin6_family;
+        csk->saddr6.sin6_family = daddr6->sin6_family;
         csk->saddr6.sin6_addr = pref_saddr;
 
         neigh_release(n);
@@ -786,7 +816,7 @@ static void cxgbi_inform_iscsi_conn_closing(struct cxgbi_sock *csk)
                 read_lock_bh(&csk->callback_lock);
                 if (csk->user_data)
                         iscsi_conn_failure(csk->user_data,
-                                        ISCSI_ERR_CONN_FAILED);
+                                        ISCSI_ERR_TCP_CONN_CLOSE);
                 read_unlock_bh(&csk->callback_lock);
         }
 }
@@ -875,18 +905,16 @@ void cxgbi_sock_rcv_abort_rpl(struct cxgbi_sock *csk)
 {
         cxgbi_sock_get(csk);
         spin_lock_bh(&csk->lock);
+
+        cxgbi_sock_set_flag(csk, CTPF_ABORT_RPL_RCVD);
         if (cxgbi_sock_flag(csk, CTPF_ABORT_RPL_PENDING)) {
-                if (!cxgbi_sock_flag(csk, CTPF_ABORT_RPL_RCVD))
-                        cxgbi_sock_set_flag(csk, CTPF_ABORT_RPL_RCVD);
-                else {
-                        cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_RCVD);
-                        cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_PENDING);
-                        if (cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD))
-                                pr_err("csk 0x%p,%u,0x%lx,%u,ABT_RPL_RSS.\n",
-                                        csk, csk->state, csk->flags, csk->tid);
-                        cxgbi_sock_closed(csk);
-                }
+                cxgbi_sock_clear_flag(csk, CTPF_ABORT_RPL_PENDING);
+                if (cxgbi_sock_flag(csk, CTPF_ABORT_REQ_RCVD))
+                        pr_err("csk 0x%p,%u,0x%lx,%u,ABT_RPL_RSS.\n",
+                               csk, csk->state, csk->flags, csk->tid);
+                cxgbi_sock_closed(csk);
         }
+
         spin_unlock_bh(&csk->lock);
         cxgbi_sock_put(csk);
 }
@@ -2647,12 +2675,14 @@ int cxgbi_get_host_param(struct Scsi_Host *shost, enum iscsi_host_param param,
                 break;
         case ISCSI_HOST_PARAM_IPADDRESS:
         {
-                __be32 addr;
-
-                addr = cxgbi_get_iscsi_ipv4(chba);
-                len = sprintf(buf, "%pI4", &addr);
+                struct cxgbi_sock *csk = find_sock_on_port(chba->cdev,
+                                                           chba->port_id);
+                if (csk) {
+                        len = sprintf(buf, "%pIS",
+                                      (struct sockaddr *)&csk->saddr);
+                }
                 log_debug(1 << CXGBI_DBG_ISCSI,
-                        "hba %s, ipv4 %pI4.\n", chba->ndev->name, &addr);
+                          "hba %s, addr %s.\n", chba->ndev->name, buf);
                 break;
         }
         default:
diff --git a/drivers/scsi/cxgbi/libcxgbi.h b/drivers/scsi/cxgbi/libcxgbi.h
index 1d98fad6a0ab..2c7cb1c0c453 100644
--- a/drivers/scsi/cxgbi/libcxgbi.h
+++ b/drivers/scsi/cxgbi/libcxgbi.h
@@ -700,11 +700,6 @@ static inline void cxgbi_set_iscsi_ipv4(struct cxgbi_hba *chba, __be32 ipaddr)
                         chba->ndev->name);
 }
 
-static inline __be32 cxgbi_get_iscsi_ipv4(struct cxgbi_hba *chba)
-{
-        return chba->ipv4addr;
-}
-
 struct cxgbi_device *cxgbi_device_register(unsigned int, unsigned int);
 void cxgbi_device_unregister(struct cxgbi_device *);
 void cxgbi_device_unregister_all(unsigned int flag);
diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c
index e99507ed0e3c..fd78bdc53528 100644
--- a/drivers/scsi/device_handler/scsi_dh_alua.c
+++ b/drivers/scsi/device_handler/scsi_dh_alua.c
@@ -474,6 +474,13 @@ static int alua_check_sense(struct scsi_device *sdev,
                          * LUN Not Ready -- Offline
                          */
                         return SUCCESS;
+                if (sdev->allow_restart &&
+                    sense_hdr->asc == 0x04 && sense_hdr->ascq == 0x02)
+                        /*
+                         * if the device is not started, we need to wake
+                         * the error handler to start the motor
+                         */
+                        return FAILED;
                 break;
         case UNIT_ATTENTION:
                 if (sense_hdr->asc == 0x29 && sense_hdr->ascq == 0x00)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
index f6a69a3b1b3f..5640ad1c8214 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -4453,7 +4453,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
                         instance->msixentry[i].entry = i;
                 i = pci_enable_msix_range(instance->pdev, instance->msixentry,
                                           1, instance->msix_vectors);
-                if (i)
+                if (i > 0)
                         instance->msix_vectors = i;
                 else
                         instance->msix_vectors = 0;
diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
index 9a6f8468225f..bc5ff6ff9c79 100644
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -459,14 +459,6 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
         if (! scsi_command_normalize_sense(scmd, &sshdr))
                 return FAILED;  /* no valid sense data */
 
-        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
-                /*
-                 * nasty: for mid-layer issued TURs, we need to return the
-                 * actual sense data without any recovery attempt.  For eh
-                 * issued ones, we need to try to recover and interpret
-                 */
-                return SUCCESS;
-
         scsi_report_sense(sdev, &sshdr);
 
         if (scsi_sense_is_deferred(&sshdr))
@@ -482,6 +474,14 @@ static int scsi_check_sense(struct scsi_cmnd *scmd)
                 /* handler does not care. Drop down to default handling */
         }
 
+        if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done)
+                /*
+                 * nasty: for mid-layer issued TURs, we need to return the
+                 * actual sense data without any recovery attempt.  For eh
+                 * issued ones, we need to try to recover and interpret
+                 */
+                return SUCCESS;
+
         /*
          * Previous logic looked for FILEMARK, EOM or ILI which are
          * mainly associated with tapes and returned SUCCESS.
@@ -2001,8 +2001,10 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
          * is no point trying to lock the door of an off-line device.
          */
         shost_for_each_device(sdev, shost) {
-                if (scsi_device_online(sdev) && sdev->locked)
+                if (scsi_device_online(sdev) && sdev->was_reset && sdev->locked) {
                         scsi_eh_lock_door(sdev);
+                        sdev->was_reset = 0;
+                }
         }
 
         /*
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9eff8a375132..50a6e1ac8d9c 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1893,6 +1893,11 @@ static int scsi_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req,
                 blk_mq_start_request(req);
         }
 
+        if (blk_queue_tagged(q))
+                req->cmd_flags |= REQ_QUEUED;
+        else
+                req->cmd_flags &= ~REQ_QUEUED;
+
         scsi_init_cmd_errh(cmd);
         cmd->scsi_done = scsi_mq_done;
 
diff --git a/drivers/soc/versatile/soc-realview.c b/drivers/soc/versatile/soc-realview.c
index cea8ea3491d2..1a07bf540fec 100644
--- a/drivers/soc/versatile/soc-realview.c
+++ b/drivers/soc/versatile/soc-realview.c
@@ -26,6 +26,7 @@ static const struct of_device_id realview_soc_of_match[] = {
         { .compatible = "arm,realview-pb11mp-soc", },
         { .compatible = "arm,realview-pba8-soc", },
         { .compatible = "arm,realview-pbx-soc", },
+        { }
 };
 
 static u32 realview_coreid;
diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
index 729215885250..72e12bad14b9 100644
--- a/drivers/spi/spi-dw.c
+++ b/drivers/spi/spi-dw.c
@@ -669,6 +669,7 @@ int dw_spi_add_host(struct device *dev, struct dw_spi *dws)
         master->cleanup = dw_spi_cleanup;
         master->transfer_one_message = dw_spi_transfer_one_message;
         master->max_speed_hz = dws->max_freq;
+        master->dev.of_node = dev->of_node;
 
         /* Basic HW init */
         spi_hw_init(dws);
diff --git a/drivers/spi/spi-fsl-dspi.c b/drivers/spi/spi-fsl-dspi.c
index 448216025ce8..831ceb4a91f6 100644
--- a/drivers/spi/spi-fsl-dspi.c
+++ b/drivers/spi/spi-fsl-dspi.c
@@ -46,7 +46,7 @@
 
 #define SPI_TCR                 0x08
 
-#define SPI_CTAR(x)             (0x0c + (x * 4))
+#define SPI_CTAR(x)             (0x0c + (((x) & 0x3) * 4))
 #define SPI_CTAR_FMSZ(x)        (((x) & 0x0000000f) << 27)
 #define SPI_CTAR_CPOL(x)        ((x) << 26)
 #define SPI_CTAR_CPHA(x)        ((x) << 25)
@@ -70,7 +70,7 @@
 
 #define SPI_PUSHR               0x34
 #define SPI_PUSHR_CONT          (1 << 31)
-#define SPI_PUSHR_CTAS(x)       (((x) & 0x00000007) << 28)
+#define SPI_PUSHR_CTAS(x)       (((x) & 0x00000003) << 28)
 #define SPI_PUSHR_EOQ           (1 << 27)
 #define SPI_PUSHR_CTCNT (1 << 26)
 #define SPI_PUSHR_PCS(x)        (((1 << x) & 0x0000003f) << 16)
diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
index 835cdda6f4f5..c76b7d7879df 100644
--- a/drivers/spi/spi-orion.c
+++ b/drivers/spi/spi-orion.c
@@ -454,7 +454,7 @@ static int orion_spi_probe(struct platform_device *pdev)
         spi->master = master;
 
         of_id = of_match_device(orion_spi_of_match_table, &pdev->dev);
-        devdata = of_id->data;
+        devdata = (of_id) ? of_id->data : &orion_spi_dev_data;
         spi->devdata = devdata;
 
         spi->clk = devm_clk_get(&pdev->dev, NULL);
diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
index f35f723816ea..fc2dd8441608 100644
--- a/drivers/spi/spi-pl022.c
+++ b/drivers/spi/spi-pl022.c
@@ -1106,7 +1106,7 @@ err_rxdesc:
                      pl022->sgt_tx.nents, DMA_TO_DEVICE);
 err_tx_sgmap:
         dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl,
-                     pl022->sgt_tx.nents, DMA_FROM_DEVICE);
+                     pl022->sgt_rx.nents, DMA_FROM_DEVICE);
 err_rx_sgmap:
         sg_free_table(&pl022->sgt_tx);
 err_alloc_tx_sg:
diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
index d8a105f76837..9e9e0f971e6c 100644
--- a/drivers/spi/spi-pxa2xx.c
+++ b/drivers/spi/spi-pxa2xx.c
@@ -1274,7 +1274,9 @@ static int pxa2xx_spi_suspend(struct device *dev)
         if (status != 0)
                 return status;
         write_SSCR0(0, drv_data->ioaddr);
-        clk_disable_unprepare(ssp->clk);
+
+        if (!pm_runtime_suspended(dev))
+                clk_disable_unprepare(ssp->clk);
 
         return 0;
 }
@@ -1288,7 +1290,8 @@ static int pxa2xx_spi_resume(struct device *dev)
         pxa2xx_spi_dma_resume(drv_data);
 
         /* Enable the SSP clock */
-        clk_prepare_enable(ssp->clk);
+        if (!pm_runtime_suspended(dev))
+                clk_prepare_enable(ssp->clk);
 
         /* Restore LPSS private register bits */
         lpss_ssp_setup(drv_data);
diff --git a/drivers/spi/spi-rockchip.c b/drivers/spi/spi-rockchip.c
index f96ea8a38d64..87bc16f491f0 100644
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -145,6 +145,9 @@
 #define RXBUSY                                          (1 << 0)
 #define TXBUSY                                          (1 << 1)
 
+/* sclk_out: spi master internal logic in rk3x can support 50Mhz */
+#define MAX_SCLK_OUT            50000000
+
 enum rockchip_ssi_type {
         SSI_MOTO_SPI = 0,
         SSI_TI_SSP,
@@ -325,6 +328,8 @@ static int rockchip_spi_unprepare_message(struct spi_master *master,
 
         spin_unlock_irqrestore(&rs->lock, flags);
 
+        spi_enable_chip(rs, 0);
+
         return 0;
 }
 
@@ -381,6 +386,8 @@ static int rockchip_spi_pio_transfer(struct rockchip_spi *rs)
         if (rs->tx)
                 wait_for_idle(rs);
 
+        spi_enable_chip(rs, 0);
+
         return 0;
 }
 
@@ -392,8 +399,10 @@ static void rockchip_spi_dma_rxcb(void *data)
         spin_lock_irqsave(&rs->lock, flags);
 
         rs->state &= ~RXBUSY;
-        if (!(rs->state & TXBUSY))
+        if (!(rs->state & TXBUSY)) {
+                spi_enable_chip(rs, 0);
                 spi_finalize_current_transfer(rs->master);
+        }
 
         spin_unlock_irqrestore(&rs->lock, flags);
 }
@@ -409,8 +418,10 @@ static void rockchip_spi_dma_txcb(void *data)
         spin_lock_irqsave(&rs->lock, flags);
 
         rs->state &= ~TXBUSY;
-        if (!(rs->state & RXBUSY))
+        if (!(rs->state & RXBUSY)) {
+                spi_enable_chip(rs, 0);
                 spi_finalize_current_transfer(rs->master);
+        }
 
         spin_unlock_irqrestore(&rs->lock, flags);
 }
@@ -496,12 +507,19 @@ static void rockchip_spi_config(struct rockchip_spi *rs)
                         dmacr |= RF_DMA_EN;
         }
 
+        if (WARN_ON(rs->speed > MAX_SCLK_OUT))
+                rs->speed = MAX_SCLK_OUT;
+
+        /* the minimum divsor is 2 */
+        if (rs->max_freq < 2 * rs->speed) {
+                clk_set_rate(rs->spiclk, 2 * rs->speed);
+                rs->max_freq = clk_get_rate(rs->spiclk);
+        }
+
         /* div doesn't support odd number */
         div = max_t(u32, rs->max_freq / rs->speed, 1);
         div = (div + 1) & 0xfffe;
 
-        spi_enable_chip(rs, 0);
-
         writel_relaxed(cr0, rs->regs + ROCKCHIP_SPI_CTRLR0);
 
         writel_relaxed(rs->len - 1, rs->regs + ROCKCHIP_SPI_CTRLR1);
@@ -515,8 +533,6 @@ static void rockchip_spi_config(struct rockchip_spi *rs)
         spi_set_clk(rs, div);
 
         dev_dbg(rs->dev, "cr0 0x%x, div %d\n", cr0, div);
-
-        spi_enable_chip(rs, 1);
 }
 
 static int rockchip_spi_transfer_one(
@@ -524,7 +540,7 @@ static int rockchip_spi_transfer_one(
                 struct spi_device *spi,
                 struct spi_transfer *xfer)
 {
-        int ret = 0;
+        int ret = 1;
         struct rockchip_spi *rs = spi_master_get_devdata(master);
 
         WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
@@ -556,17 +572,27 @@ static int rockchip_spi_transfer_one(
                 rs->tmode = CR0_XFM_RO;
 
         /* we need prepare dma before spi was enabled */
-        if (master->can_dma && master->can_dma(master, spi, xfer)) {
+        if (master->can_dma && master->can_dma(master, spi, xfer))
                 rs->use_dma = 1;
-                rockchip_spi_prepare_dma(rs);
-        } else {
+        else
                 rs->use_dma = 0;
-        }
 
         rockchip_spi_config(rs);
 
-        if (!rs->use_dma)
+        if (rs->use_dma) {
+                if (rs->tmode == CR0_XFM_RO) {
+                        /* rx: dma must be prepared first */
+                        rockchip_spi_prepare_dma(rs);
+                        spi_enable_chip(rs, 1);
+                } else {
+                        /* tx or tr: spi must be enabled first */
+                        spi_enable_chip(rs, 1);
+                        rockchip_spi_prepare_dma(rs);
+                }
+        } else {
+                spi_enable_chip(rs, 1);
                 ret = rockchip_spi_pio_transfer(rs);
+        }
 
         return ret;
 }
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index e3bc23bb5883..e50039fb1474 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -82,10 +82,11 @@ struct spidev_data {
         struct spi_device       *spi;
         struct list_head        device_entry;
 
-        /* buffer is NULL unless this device is open (users > 0) */
+        /* TX/RX buffers are NULL unless this device is open (users > 0) */
         struct mutex            buf_lock;
         unsigned                users;
-        u8                      *buffer;
+        u8                      *tx_buffer;
+        u8                      *rx_buffer;
 };
 
 static LIST_HEAD(device_list);
@@ -135,7 +136,7 @@ static inline ssize_t
 spidev_sync_write(struct spidev_data *spidev, size_t len)
 {
         struct spi_transfer     t = {
-                        .tx_buf         = spidev->buffer,
+                        .tx_buf         = spidev->tx_buffer,
                         .len            = len,
                 };
         struct spi_message      m;
@@ -149,7 +150,7 @@ static inline ssize_t
 spidev_sync_read(struct spidev_data *spidev, size_t len)
 {
         struct spi_transfer     t = {
-                        .rx_buf         = spidev->buffer,
+                        .rx_buf         = spidev->rx_buffer,
                         .len            = len,
                 };
         struct spi_message      m;
@@ -179,7 +180,7 @@ spidev_read(struct file *filp, char __user *buf, size_t count, loff_t *f_pos)
         if (status > 0) {
                 unsigned long   missing;
 
-                missing = copy_to_user(buf, spidev->buffer, status);
+                missing = copy_to_user(buf, spidev->rx_buffer, status);
                 if (missing == status)
                         status = -EFAULT;
                 else
@@ -206,7 +207,7 @@ spidev_write(struct file *filp, const char __user *buf,
         spidev = filp->private_data;
 
         mutex_lock(&spidev->buf_lock);
-        missing = copy_from_user(spidev->buffer, buf, count);
+        missing = copy_from_user(spidev->tx_buffer, buf, count);
         if (missing == 0)
                 status = spidev_sync_write(spidev, count);
         else
@@ -224,7 +225,7 @@ static int spidev_message(struct spidev_data *spidev,
         struct spi_transfer     *k_tmp;
         struct spi_ioc_transfer *u_tmp;
         unsigned                n, total;
-        u8                      *buf;
+        u8                      *tx_buf, *rx_buf;
         int                     status = -EFAULT;
 
         spi_message_init(&msg);
@@ -236,7 +237,8 @@ static int spidev_message(struct spidev_data *spidev,
          * We walk the array of user-provided transfers, using each one
          * to initialize a kernel version of the same transfer.
          */
-        buf = spidev->buffer;
+        tx_buf = spidev->tx_buffer;
+        rx_buf = spidev->rx_buffer;
         total = 0;
         for (n = n_xfers, k_tmp = k_xfers, u_tmp = u_xfers;
                         n;
@@ -250,20 +252,21 @@ static int spidev_message(struct spidev_data *spidev,
                 }
 
                 if (u_tmp->rx_buf) {
-                        k_tmp->rx_buf = buf;
+                        k_tmp->rx_buf = rx_buf;
                         if (!access_ok(VERIFY_WRITE, (u8 __user *)
                                                 (uintptr_t) u_tmp->rx_buf,
                                                 u_tmp->len))
                                 goto done;
                 }
                 if (u_tmp->tx_buf) {
-                        k_tmp->tx_buf = buf;
-                        if (copy_from_user(buf, (const u8 __user *)
+                        k_tmp->tx_buf = tx_buf;
+                        if (copy_from_user(tx_buf, (const u8 __user *)
                                                 (uintptr_t) u_tmp->tx_buf,
                                         u_tmp->len))
                                 goto done;
                 }
-                buf += k_tmp->len;
+                tx_buf += k_tmp->len;
+                rx_buf += k_tmp->len;
 
                 k_tmp->cs_change = !!u_tmp->cs_change;
                 k_tmp->tx_nbits = u_tmp->tx_nbits;
@@ -290,17 +293,17 @@ static int spidev_message(struct spidev_data *spidev,
                 goto done;
 
         /* copy any rx data out of bounce buffer */
-        buf = spidev->buffer;
+        rx_buf = spidev->rx_buffer;
         for (n = n_xfers, u_tmp = u_xfers; n; n--, u_tmp++) {
                 if (u_tmp->rx_buf) {
                         if (__copy_to_user((u8 __user *)
-                                        (uintptr_t) u_tmp->rx_buf, buf,
+                                        (uintptr_t) u_tmp->rx_buf, rx_buf,
                                         u_tmp->len)) {
                                 status = -EFAULT;
                                 goto done;
                         }
                 }
-                buf += u_tmp->len;
+                rx_buf += u_tmp->len;
         }
         status = total;
 
@@ -508,22 +511,41 @@ static int spidev_open(struct inode *inode, struct file *filp)
                         break;
                 }
         }
-        if (status == 0) {
-                if (!spidev->buffer) {
-                        spidev->buffer = kmalloc(bufsiz, GFP_KERNEL);
-                        if (!spidev->buffer) {
+
+        if (status) {
+                pr_debug("spidev: nothing for minor %d\n", iminor(inode));
+                goto err_find_dev;
+        }
+
+        if (!spidev->tx_buffer) {
+                spidev->tx_buffer = kmalloc(bufsiz, GFP_KERNEL);
+                if (!spidev->tx_buffer) {
                                 dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
                                 status = -ENOMEM;
+                        goto err_find_dev;
                         }
                 }
-                if (status == 0) {
-                        spidev->users++;
-                        filp->private_data = spidev;
-                        nonseekable_open(inode, filp);
+
+        if (!spidev->rx_buffer) {
+                spidev->rx_buffer = kmalloc(bufsiz, GFP_KERNEL);
+                if (!spidev->rx_buffer) {
+                        dev_dbg(&spidev->spi->dev, "open/ENOMEM\n");
+                        status = -ENOMEM;
+                        goto err_alloc_rx_buf;
                 }
-        } else
-                pr_debug("spidev: nothing for minor %d\n", iminor(inode));
+        }
+
+        spidev->users++;
+        filp->private_data = spidev;
+        nonseekable_open(inode, filp);
+
+        mutex_unlock(&device_list_lock);
+        return 0;
 
+err_alloc_rx_buf:
+        kfree(spidev->tx_buffer);
+        spidev->tx_buffer = NULL;
+err_find_dev:
         mutex_unlock(&device_list_lock);
         return status;
 }
@@ -542,8 +564,11 @@ static int spidev_release(struct inode *inode, struct file *filp)
         if (!spidev->users) {
                 int             dofree;
 
-                kfree(spidev->buffer);
-                spidev->buffer = NULL;
+                kfree(spidev->tx_buffer);
+                spidev->tx_buffer = NULL;
+
+                kfree(spidev->rx_buffer);
+                spidev->rx_buffer = NULL;
 
                 /* ... after we unbound from the underlying device? */
                 spin_lock_irq(&spidev->spi_lock);
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index a8bc2b567789..152f4c12ea43 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -426,6 +426,7 @@ config COMEDI_AIO_IIRO_16
 
 config COMEDI_II_PCI20KC
         tristate "Intelligent Instruments PCI-20001C carrier support"
+        depends on HAS_IOMEM
         ---help---
           Enable support for Intelligent Instruments PCI-20001C carrier
           PCI-20001, PCI-20006 and PCI-20341
@@ -667,7 +668,6 @@ config COMEDI_ADDI_APCI_2200
 config COMEDI_ADDI_APCI_3120
         tristate "ADDI-DATA APCI_3120/3001 support"
         depends on HAS_DMA
-        depends on VIRT_TO_BUS
         ---help---
           Enable support for ADDI-DATA APCI_3120/3001 cards
 
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 495969f46e76..9c32f0276009 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1462,10 +1462,7 @@ static int __comedi_get_user_chanlist(struct comedi_device *dev,
         unsigned int *chanlist;
         int ret;
 
-        /* user_chanlist could be NULL for do_cmdtest ioctls */
-        if (!user_chanlist)
-                return 0;
-
+        cmd->chanlist = NULL;
         chanlist = memdup_user(user_chanlist,
                                cmd->chanlist_len * sizeof(unsigned int));
         if (IS_ERR(chanlist))
@@ -1609,13 +1606,18 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
 
         s = &dev->subdevices[cmd.subdev];
 
-        /* load channel/gain list */
-        ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
-        if (ret)
-                return ret;
+        /* user_chanlist can be NULL for COMEDI_CMDTEST ioctl */
+        if (user_chanlist) {
+                /* load channel/gain list */
+                ret = __comedi_get_user_chanlist(dev, s, user_chanlist, &cmd);
+                if (ret)
+                        return ret;
+        }
 
         ret = s->do_cmdtest(dev, s, &cmd);
 
+        kfree(cmd.chanlist);    /* free kernel copy of user chanlist */
+
         /* restore chanlist pointer before copying back */
         cmd.chanlist = (unsigned int __force *)user_chanlist;
 
@@ -1642,7 +1644,7 @@ static int do_cmdtest_ioctl(struct comedi_device *dev,
 
 */
 
-static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_lock_ioctl(struct comedi_device *dev, unsigned long arg,
                          void *file)
 {
         int ret = 0;
@@ -1679,7 +1681,7 @@ static int do_lock_ioctl(struct comedi_device *dev, unsigned int arg,
         This function isn't protected by the semaphore, since
         we already own the lock.
 */
-static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_unlock_ioctl(struct comedi_device *dev, unsigned long arg,
                            void *file)
 {
         struct comedi_subdevice *s;
@@ -1714,7 +1716,7 @@ static int do_unlock_ioctl(struct comedi_device *dev, unsigned int arg,
                 nothing
 
 */
-static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_cancel_ioctl(struct comedi_device *dev, unsigned long arg,
                            void *file)
 {
         struct comedi_subdevice *s;
@@ -1751,7 +1753,7 @@ static int do_cancel_ioctl(struct comedi_device *dev, unsigned int arg,
                 nothing
 
 */
-static int do_poll_ioctl(struct comedi_device *dev, unsigned int arg,
+static int do_poll_ioctl(struct comedi_device *dev, unsigned long arg,
                          void *file)
 {
         struct comedi_subdevice *s;
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index 32a19264a170..2a29b9baec0d 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -1559,14 +1559,16 @@ static int mxs_lradc_probe(struct platform_device *pdev)
         /* Grab all IRQ sources */
         for (i = 0; i < of_cfg->irq_count; i++) {
                 lradc->irq[i] = platform_get_irq(pdev, i);
-                if (lradc->irq[i] < 0)
-                        return lradc->irq[i];
+                if (lradc->irq[i] < 0) {
+                        ret = lradc->irq[i];
+                        goto err_clk;
+                }
 
                 ret = devm_request_irq(dev, lradc->irq[i],
                                         mxs_lradc_handle_irq, 0,
                                         of_cfg->irq_name[i], iio);
                 if (ret)
-                        return ret;
+                        goto err_clk;
         }
 
         lradc->vref_mv = of_cfg->vref_mv;
@@ -1588,7 +1590,7 @@ static int mxs_lradc_probe(struct platform_device *pdev)
                                 &mxs_lradc_trigger_handler,
                                 &mxs_lradc_buffer_ops);
         if (ret)
-                return ret;
+                goto err_clk;
 
         ret = mxs_lradc_trigger_init(iio);
         if (ret)
@@ -1643,6 +1645,8 @@ err_dev:
         mxs_lradc_trigger_remove(iio);
 err_trig:
         iio_triggered_buffer_cleanup(iio);
+err_clk:
+        clk_disable_unprepare(lradc->clk);
         return ret;
 }
 
diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
index d0c89d0457de..b6bd609c3655 100644
--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
+++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
@@ -115,6 +115,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .channel = 0,
                 .info_mask_separate = BIT(IIO_CHAN_INFO_PROCESSED),
                 .address = AD5933_REG_TEMP_DATA,
+                .scan_index = -1,
                 .scan_type = {
                         .sign = 's',
                         .realbits = 14,
@@ -124,9 +125,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "real_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-                BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "real",
                 .address = AD5933_REG_REAL_DATA,
                 .scan_index = 0,
                 .scan_type = {
@@ -138,9 +137,7 @@ static const struct iio_chan_spec ad5933_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "imag_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW) |
-                BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "imag",
                 .address = AD5933_REG_IMAG_DATA,
                 .scan_index = 1,
                 .scan_type = {
@@ -749,14 +746,14 @@ static int ad5933_probe(struct i2c_client *client,
         indio_dev->name = id->name;
         indio_dev->modes = INDIO_DIRECT_MODE;
         indio_dev->channels = ad5933_channels;
-        indio_dev->num_channels = 1; /* only register temp0_input */
+        indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
 
         ret = ad5933_register_ring_funcs_and_init(indio_dev);
         if (ret)
                 goto error_disable_reg;
 
-        /* skip temp0_input, register in0_(real|imag)_raw */
-        ret = iio_buffer_register(indio_dev, &ad5933_channels[1], 2);
+        ret = iio_buffer_register(indio_dev, ad5933_channels,
+                ARRAY_SIZE(ad5933_channels));
         if (ret)
                 goto error_unreg_ring;
 
diff --git a/drivers/staging/iio/meter/ade7758.h b/drivers/staging/iio/meter/ade7758.h
index 07318203a836..e8c98cf57070 100644
--- a/drivers/staging/iio/meter/ade7758.h
+++ b/drivers/staging/iio/meter/ade7758.h
@@ -119,7 +119,6 @@ struct ade7758_state {
         u8                      *tx;
         u8                      *rx;
         struct mutex            buf_lock;
-        const struct iio_chan_spec *ade7758_ring_channels;
         struct spi_transfer     ring_xfer[4];
         struct spi_message      ring_msg;
         /*
diff --git a/drivers/staging/iio/meter/ade7758_core.c b/drivers/staging/iio/meter/ade7758_core.c
index abc60067cd72..fb373b89dcc2 100644
--- a/drivers/staging/iio/meter/ade7758_core.c
+++ b/drivers/staging/iio/meter/ade7758_core.c
@@ -634,9 +634,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_VOLTAGE),
                 .scan_index = 0,
                 .scan_type = {
@@ -648,9 +645,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_CURRENT),
                 .scan_index = 1,
                 .scan_type = {
@@ -662,9 +656,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_APP_PWR),
                 .scan_index = 2,
                 .scan_type = {
@@ -676,9 +668,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_ACT_PWR),
                 .scan_index = 3,
                 .scan_type = {
@@ -690,9 +680,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 0,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_A, AD7758_REACT_PWR),
                 .scan_index = 4,
                 .scan_type = {
@@ -704,9 +692,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_VOLTAGE),
                 .scan_index = 5,
                 .scan_type = {
@@ -718,9 +703,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_CURRENT),
                 .scan_index = 6,
                 .scan_type = {
@@ -732,9 +714,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_APP_PWR),
                 .scan_index = 7,
                 .scan_type = {
@@ -746,9 +726,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_ACT_PWR),
                 .scan_index = 8,
                 .scan_type = {
@@ -760,9 +738,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 1,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_B, AD7758_REACT_PWR),
                 .scan_index = 9,
                 .scan_type = {
@@ -774,9 +750,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_VOLTAGE,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_VOLTAGE),
                 .scan_index = 10,
                 .scan_type = {
@@ -788,9 +761,6 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_CURRENT,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_CURRENT),
                 .scan_index = 11,
                 .scan_type = {
@@ -802,9 +772,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "apparent_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "apparent",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_APP_PWR),
                 .scan_index = 12,
                 .scan_type = {
@@ -816,9 +784,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "active_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "active",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_ACT_PWR),
                 .scan_index = 13,
                 .scan_type = {
@@ -830,9 +796,7 @@ static const struct iio_chan_spec ade7758_channels[] = {
                 .type = IIO_POWER,
                 .indexed = 1,
                 .channel = 2,
-                .extend_name = "reactive_raw",
-                .info_mask_separate = BIT(IIO_CHAN_INFO_RAW),
-                .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE),
+                .extend_name = "reactive",
                 .address = AD7758_WT(AD7758_PHASE_C, AD7758_REACT_PWR),
                 .scan_index = 14,
                 .scan_type = {
@@ -873,13 +837,14 @@ static int ade7758_probe(struct spi_device *spi)
                 goto error_free_rx;
         }
         st->us = spi;
-        st->ade7758_ring_channels = &ade7758_channels[0];
         mutex_init(&st->buf_lock);
 
         indio_dev->name = spi->dev.driver->name;
         indio_dev->dev.parent = &spi->dev;
         indio_dev->info = &ade7758_info;
         indio_dev->modes = INDIO_DIRECT_MODE;
+        indio_dev->channels = ade7758_channels;
+        indio_dev->num_channels = ARRAY_SIZE(ade7758_channels);
 
         ret = ade7758_configure_ring(indio_dev);
         if (ret)
diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c
index c0accf8cce93..6e9006490742 100644
--- a/drivers/staging/iio/meter/ade7758_ring.c
+++ b/drivers/staging/iio/meter/ade7758_ring.c
@@ -85,17 +85,16 @@ static irqreturn_t ade7758_trigger_handler(int irq, void *p)
  **/
 static int ade7758_ring_preenable(struct iio_dev *indio_dev)
 {
-        struct ade7758_state *st = iio_priv(indio_dev);
         unsigned channel;
 
-        if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
+        if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
                 return -EINVAL;
 
         channel = find_first_bit(indio_dev->active_scan_mask,
                                  indio_dev->masklength);
 
         ade7758_write_waveform_type(&indio_dev->dev,
-                st->ade7758_ring_channels[channel].address);
+                indio_dev->channels[channel].address);
 
         return 0;
 }
diff --git a/drivers/staging/rtl8723au/include/rtw_eeprom.h b/drivers/staging/rtl8723au/include/rtw_eeprom.h
index e5121a2a64b4..a86f36e49dd1 100644
--- a/drivers/staging/rtl8723au/include/rtw_eeprom.h
+++ b/drivers/staging/rtl8723au/include/rtw_eeprom.h
@@ -107,12 +107,12 @@ enum rt_customer_id
 };
 
 struct eeprom_priv {
+        u8              mac_addr[6];    /* PermanentAddress */
         u8              bautoload_fail_flag;
         u8              bloadfile_fail_flag;
         u8              bloadmac_fail_flag;
         /* u8           bempty; */
         /* u8           sys_config; */
-        u8              mac_addr[6];    /* PermanentAddress */
         /* u8           config0; */
         u16             channel_plan;
         /* u8           country_string[3]; */
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index b19e4329ba00..73e58d22e325 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -3491,7 +3491,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd,
                                 len = sprintf(buf, "TargetAddress="
                                         "%s:%hu,%hu",
                                         inaddr_any ? conn->local_ip : np->np_ip,
-                                        inaddr_any ? conn->local_port : np->np_port,
+                                        np->np_port,
                                         tpg->tpgt);
                                 len += 1;
 
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index 8c60a1a1ae8d..9f93b8234095 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2738,7 +2738,8 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
         struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_reg_n, *pr_res_holder;
         struct t10_reservation *pr_tmpl = &dev->t10_pr;
         u32 pr_res_mapped_lun = 0;
-        int all_reg = 0, calling_it_nexus = 0, released_regs = 0;
+        int all_reg = 0, calling_it_nexus = 0;
+        bool sa_res_key_unmatched = sa_res_key != 0;
         int prh_type = 0, prh_scope = 0;
 
         if (!se_sess)
@@ -2813,6 +2814,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                         if (!all_reg) {
                                 if (pr_reg->pr_res_key != sa_res_key)
                                         continue;
+                                sa_res_key_unmatched = false;
 
                                 calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
                                 pr_reg_nacl = pr_reg->pr_reg_nacl;
@@ -2820,7 +2822,6 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 __core_scsi3_free_registration(dev, pr_reg,
                                         (preempt_type == PREEMPT_AND_ABORT) ? &preempt_and_abort_list :
                                                 NULL, calling_it_nexus);
-                                released_regs++;
                         } else {
                                 /*
                                  * Case for any existing all registrants type
@@ -2838,6 +2839,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 if ((sa_res_key) &&
                                      (pr_reg->pr_res_key != sa_res_key))
                                         continue;
+                                sa_res_key_unmatched = false;
 
                                 calling_it_nexus = (pr_reg_n == pr_reg) ? 1 : 0;
                                 if (calling_it_nexus)
@@ -2848,7 +2850,6 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                                 __core_scsi3_free_registration(dev, pr_reg,
                                         (preempt_type == PREEMPT_AND_ABORT) ? &preempt_and_abort_list :
                                                 NULL, 0);
-                                released_regs++;
                         }
                         if (!calling_it_nexus)
                                 core_scsi3_ua_allocate(pr_reg_nacl,
@@ -2863,7 +2864,7 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
                  * registered reservation key, then the device server shall
                  * complete the command with RESERVATION CONFLICT status.
                  */
-                if (!released_regs) {
+                if (sa_res_key_unmatched) {
                         spin_unlock(&dev->dev_reservation_lock);
                         core_scsi3_put_pr_reg(pr_reg_n);
                         return TCM_RESERVATION_CONFLICT;
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 9ea0d5f03f7a..be877bf6f730 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -2292,7 +2292,7 @@ transport_generic_new_cmd(struct se_cmd *cmd)
          * and let it call back once the write buffers are ready.
          */
         target_add_to_state_list(cmd);
-        if (cmd->data_direction != DMA_TO_DEVICE) {
+        if (cmd->data_direction != DMA_TO_DEVICE || cmd->data_length == 0) {
                 target_execute_cmd(cmd);
                 return 0;
         }
diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c
index 461bf3d033a0..5a1f1070b702 100644
--- a/drivers/thermal/imx_thermal.c
+++ b/drivers/thermal/imx_thermal.c
@@ -459,6 +459,10 @@ static int imx_thermal_probe(struct platform_device *pdev)
         int measure_freq;
         int ret;
 
+        if (!cpufreq_get_current_driver()) {
+                dev_dbg(&pdev->dev, "no cpufreq driver!");
+                return -EPROBE_DEFER;
+        }
         data = devm_kzalloc(&pdev->dev, sizeof(*data), GFP_KERNEL);
         if (!data)
                 return -ENOMEM;
@@ -521,6 +525,30 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 return ret;
         }
 
+        data->thermal_clk = devm_clk_get(&pdev->dev, NULL);
+        if (IS_ERR(data->thermal_clk)) {
+                ret = PTR_ERR(data->thermal_clk);
+                if (ret != -EPROBE_DEFER)
+                        dev_err(&pdev->dev,
+                                "failed to get thermal clk: %d\n", ret);
+                cpufreq_cooling_unregister(data->cdev);
+                return ret;
+        }
+
+        /*
+         * Thermal sensor needs clk on to get correct value, normally
+         * we should enable its clk before taking measurement and disable
+         * clk after measurement is done, but if alarm function is enabled,
+         * hardware will auto measure the temperature periodically, so we
+         * need to keep the clk always on for alarm function.
+         */
+        ret = clk_prepare_enable(data->thermal_clk);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to enable thermal clk: %d\n", ret);
+                cpufreq_cooling_unregister(data->cdev);
+                return ret;
+        }
+
         data->tz = thermal_zone_device_register("imx_thermal_zone",
                                                 IMX_TRIP_NUM,
                                                 BIT(IMX_TRIP_PASSIVE), data,
@@ -531,26 +559,11 @@ static int imx_thermal_probe(struct platform_device *pdev)
                 ret = PTR_ERR(data->tz);
                 dev_err(&pdev->dev,
                         "failed to register thermal zone device %d\n", ret);
+                clk_disable_unprepare(data->thermal_clk);
                 cpufreq_cooling_unregister(data->cdev);
                 return ret;
         }
 
-        data->thermal_clk = devm_clk_get(&pdev->dev, NULL);
-        if (IS_ERR(data->thermal_clk)) {
-                dev_warn(&pdev->dev, "failed to get thermal clk!\n");
-        } else {
-                /*
-                 * Thermal sensor needs clk on to get correct value, normally
-                 * we should enable its clk before taking measurement and disable
-                 * clk after measurement is done, but if alarm function is enabled,
-                 * hardware will auto measure the temperature periodically, so we
-                 * need to keep the clk always on for alarm function.
-                 */
-                ret = clk_prepare_enable(data->thermal_clk);
-                if (ret)
-                        dev_warn(&pdev->dev, "failed to enable thermal clk: %d\n", ret);
-        }
-
         /* Enable measurements at ~ 10 Hz */
         regmap_write(map, TEMPSENSE1 + REG_CLR, TEMPSENSE1_MEASURE_FREQ);
         measure_freq = DIV_ROUND_UP(32768, 10); /* 10 Hz */
diff --git a/drivers/thermal/int340x_thermal/int3403_thermal.c b/drivers/thermal/int340x_thermal/int3403_thermal.c
index d20dba986f0f..6e9fb62eb817 100644
--- a/drivers/thermal/int340x_thermal/int3403_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3403_thermal.c
@@ -92,7 +92,13 @@ static int sys_get_trip_hyst(struct thermal_zone_device *tzone,
         if (ACPI_FAILURE(status))
                 return -EIO;
 
-        *temp = DECI_KELVIN_TO_MILLI_CELSIUS(hyst, KELVIN_OFFSET);
+        /*
+         * Thermal hysteresis represents a temperature difference.
+         * Kelvin and Celsius have same degree size. So the
+         * conversion here between tenths of degree Kelvin unit
+         * and Milli-Celsius unit is just to multiply 100.
+         */
+        *temp = hyst * 100;
 
         return 0;
 }
diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
index f8eb625b8400..62143ba31001 100644
--- a/drivers/thermal/of-thermal.c
+++ b/drivers/thermal/of-thermal.c
@@ -387,15 +387,18 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id,
                                 int (*get_trend)(void *, long *))
 {
         struct device_node *np, *child, *sensor_np;
+        struct thermal_zone_device *tzd = ERR_PTR(-ENODEV);
 
         np = of_find_node_by_name(NULL, "thermal-zones");
         if (!np)
                 return ERR_PTR(-ENODEV);
 
-        if (!dev || !dev->of_node)
+        if (!dev || !dev->of_node) {
+                of_node_put(np);
                 return ERR_PTR(-EINVAL);
+        }
 
-        sensor_np = dev->of_node;
+        sensor_np = of_node_get(dev->of_node);
 
         for_each_child_of_node(np, child) {
                 struct of_phandle_args sensor_specs;
@@ -422,16 +425,21 @@ thermal_zone_of_sensor_register(struct device *dev, int sensor_id,
                 }
 
                 if (sensor_specs.np == sensor_np && id == sensor_id) {
-                        of_node_put(np);
-                        return thermal_zone_of_add_sensor(child, sensor_np,
-                                                          data,
-                                                          get_temp,
-                                                          get_trend);
+                        tzd = thermal_zone_of_add_sensor(child, sensor_np,
+                                                         data,
+                                                         get_temp,
+                                                         get_trend);
+                        of_node_put(sensor_specs.np);
+                        of_node_put(child);
+                        goto exit;
                 }
+                of_node_put(sensor_specs.np);
         }
+exit:
+        of_node_put(sensor_np);
         of_node_put(np);
 
-        return ERR_PTR(-ENODEV);
+        return tzd;
 }
 EXPORT_SYMBOL_GPL(thermal_zone_of_sensor_register);
 
@@ -623,6 +631,7 @@ static int thermal_of_populate_trip(struct device_node *np,
 
         /* Required for cooling map matching */
         trip->np = np;
+        of_node_get(np);
 
         return 0;
 }
@@ -730,9 +739,14 @@ finish:
         return tz;
 
 free_tbps:
+        for (i = 0; i < tz->num_tbps; i++)
+                of_node_put(tz->tbps[i].cooling_device);
         kfree(tz->tbps);
 free_trips:
+        for (i = 0; i < tz->ntrips; i++)
+                of_node_put(tz->trips[i].np);
         kfree(tz->trips);
+        of_node_put(gchild);
 free_tz:
         kfree(tz);
         of_node_put(child);
@@ -742,7 +756,13 @@ free_tz:
 
 static inline void of_thermal_free_zone(struct __thermal_zone *tz)
 {
+        int i;
+
+        for (i = 0; i < tz->num_tbps; i++)
+                of_node_put(tz->tbps[i].cooling_device);
         kfree(tz->tbps);
+        for (i = 0; i < tz->ntrips; i++)
+                of_node_put(tz->trips[i].np);
         kfree(tz->trips);
         kfree(tz);
 }
@@ -814,10 +834,13 @@ int __init of_parse_thermal_zones(void)
                         /* attempting to build remaining zones still */
                 }
         }
+        of_node_put(np);
 
         return 0;
 
 exit_free:
+        of_node_put(child);
+        of_node_put(np);
         of_thermal_free_zone(tz);
 
         /* no memory available, so free what we have built */
@@ -859,4 +882,5 @@ void of_thermal_destroy_zones(void)
                 kfree(zone->ops);
                 of_thermal_free_zone(zone->devdata);
         }
+        of_node_put(np);
 }
diff --git a/drivers/thermal/samsung/exynos_thermal_common.h b/drivers/thermal/samsung/exynos_thermal_common.h
index 3eb2ed9ea3a4..158f5aa8dc5d 100644
--- a/drivers/thermal/samsung/exynos_thermal_common.h
+++ b/drivers/thermal/samsung/exynos_thermal_common.h
@@ -27,7 +27,7 @@
 #define SENSOR_NAME_LEN 16
 #define MAX_TRIP_COUNT  8
 #define MAX_COOLING_DEVICE 4
-#define MAX_THRESHOLD_LEVS 5
+#define MAX_TRIMINFO_CTRL_REG   2
 
 #define ACTIVE_INTERVAL 500
 #define IDLE_INTERVAL 10000
diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c
index acbff14da3a4..49c09243fd38 100644
--- a/drivers/thermal/samsung/exynos_tmu.c
+++ b/drivers/thermal/samsung/exynos_tmu.c
@@ -77,16 +77,6 @@ static int temp_to_code(struct exynos_tmu_data *data, u8 temp)
         struct exynos_tmu_platform_data *pdata = data->pdata;
         int temp_code;
 
-        if (pdata->cal_mode == HW_MODE)
-                return temp;
-
-        if (data->soc == SOC_ARCH_EXYNOS4210)
-                /* temp should range between 25 and 125 */
-                if (temp < 25 || temp > 125) {
-                        temp_code = -EINVAL;
-                        goto out;
-                }
-
         switch (pdata->cal_type) {
         case TYPE_TWO_POINT_TRIMMING:
                 temp_code = (temp - pdata->first_point_trim) *
@@ -101,7 +91,7 @@ static int temp_to_code(struct exynos_tmu_data *data, u8 temp)
                 temp_code = temp + pdata->default_temp_offset;
                 break;
         }
-out:
+
         return temp_code;
 }
 
@@ -114,16 +104,6 @@ static int code_to_temp(struct exynos_tmu_data *data, u8 temp_code)
         struct exynos_tmu_platform_data *pdata = data->pdata;
         int temp;
 
-        if (pdata->cal_mode == HW_MODE)
-                return temp_code;
-
-        if (data->soc == SOC_ARCH_EXYNOS4210)
-                /* temp_code should range between 75 and 175 */
-                if (temp_code < 75 || temp_code > 175) {
-                        temp = -ENODATA;
-                        goto out;
-                }
-
         switch (pdata->cal_type) {
         case TYPE_TWO_POINT_TRIMMING:
                 temp = (temp_code - data->temp_error1) *
@@ -138,18 +118,35 @@ static int code_to_temp(struct exynos_tmu_data *data, u8 temp_code)
                 temp = temp_code - pdata->default_temp_offset;
                 break;
         }
-out:
+
         return temp;
 }
 
+static void exynos_tmu_clear_irqs(struct exynos_tmu_data *data)
+{
+        const struct exynos_tmu_registers *reg = data->pdata->registers;
+        unsigned int val_irq;
+
+        val_irq = readl(data->base + reg->tmu_intstat);
+        /*
+         * Clear the interrupts.  Please note that the documentation for
+         * Exynos3250, Exynos4412, Exynos5250 and Exynos5260 incorrectly
+         * states that INTCLEAR register has a different placing of bits
+         * responsible for FALL IRQs than INTSTAT register.  Exynos5420
+         * and Exynos5440 documentation is correct (Exynos4210 doesn't
+         * support FALL IRQs at all).
+         */
+        writel(val_irq, data->base + reg->tmu_intclear);
+}
+
 static int exynos_tmu_initialize(struct platform_device *pdev)
 {
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int status, trim_info = 0, con;
+        unsigned int status, trim_info = 0, con, ctrl;
         unsigned int rising_threshold = 0, falling_threshold = 0;
-        int ret = 0, threshold_code, i, trigger_levs = 0;
+        int ret = 0, threshold_code, i;
 
         mutex_lock(&data->lock);
         clk_enable(data->clk);
@@ -164,11 +161,17 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
                 }
         }
 
-        if (TMU_SUPPORTS(pdata, TRIM_RELOAD))
-                __raw_writel(1, data->base + reg->triminfo_ctrl);
-
-        if (pdata->cal_mode == HW_MODE)
-                goto skip_calib_data;
+        if (TMU_SUPPORTS(pdata, TRIM_RELOAD)) {
+                for (i = 0; i < reg->triminfo_ctrl_count; i++) {
+                        if (pdata->triminfo_reload[i]) {
+                                ctrl = readl(data->base +
+                                                reg->triminfo_ctrl[i]);
+                                ctrl |= pdata->triminfo_reload[i];
+                                writel(ctrl, data->base +
+                                                reg->triminfo_ctrl[i]);
+                        }
+                }
+        }
 
         /* Save trimming info in order to perform calibration */
         if (data->soc == SOC_ARCH_EXYNOS5440) {
@@ -197,7 +200,7 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
                         trim_info = readl(data->base + reg->triminfo_data);
         }
         data->temp_error1 = trim_info & EXYNOS_TMU_TEMP_MASK;
-        data->temp_error2 = ((trim_info >> reg->triminfo_85_shift) &
+        data->temp_error2 = ((trim_info >> EXYNOS_TRIMINFO_85_SHIFT) &
                                 EXYNOS_TMU_TEMP_MASK);
 
         if (!data->temp_error1 ||
@@ -207,67 +210,33 @@ static int exynos_tmu_initialize(struct platform_device *pdev)
 
         if (!data->temp_error2)
                 data->temp_error2 =
-                        (pdata->efuse_value >> reg->triminfo_85_shift) &
+                        (pdata->efuse_value >> EXYNOS_TRIMINFO_85_SHIFT) &
                         EXYNOS_TMU_TEMP_MASK;
 
-skip_calib_data:
-        if (pdata->max_trigger_level > MAX_THRESHOLD_LEVS) {
-                dev_err(&pdev->dev, "Invalid max trigger level\n");
-                ret = -EINVAL;
-                goto out;
-        }
-
-        for (i = 0; i < pdata->max_trigger_level; i++) {
-                if (!pdata->trigger_levels[i])
-                        continue;
-
-                if ((pdata->trigger_type[i] == HW_TRIP) &&
-                (!pdata->trigger_levels[pdata->max_trigger_level - 1])) {
-                        dev_err(&pdev->dev, "Invalid hw trigger level\n");
-                        ret = -EINVAL;
-                        goto out;
-                }
-
-                /* Count trigger levels except the HW trip*/
-                if (!(pdata->trigger_type[i] == HW_TRIP))
-                        trigger_levs++;
-        }
-
         rising_threshold = readl(data->base + reg->threshold_th0);
 
         if (data->soc == SOC_ARCH_EXYNOS4210) {
                 /* Write temperature code for threshold */
                 threshold_code = temp_to_code(data, pdata->threshold);
-                if (threshold_code < 0) {
-                        ret = threshold_code;
-                        goto out;
-                }
                 writeb(threshold_code,
                         data->base + reg->threshold_temp);
-                for (i = 0; i < trigger_levs; i++)
+                for (i = 0; i < pdata->non_hw_trigger_levels; i++)
                         writeb(pdata->trigger_levels[i], data->base +
                         reg->threshold_th0 + i * sizeof(reg->threshold_th0));
 
-                writel(reg->intclr_rise_mask, data->base + reg->tmu_intclear);
+                exynos_tmu_clear_irqs(data);
         } else {
                 /* Write temperature code for rising and falling threshold */
-                for (i = 0;
-                i < trigger_levs && i < EXYNOS_MAX_TRIGGER_PER_REG; i++) {
+                for (i = 0; i < pdata->non_hw_trigger_levels; i++) {
                         threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i]);
-                        if (threshold_code < 0) {
-                                ret = threshold_code;
-                                goto out;
-                        }
                         rising_threshold &= ~(0xff << 8 * i);
                         rising_threshold |= threshold_code << 8 * i;
                         if (pdata->threshold_falling) {
                                 threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i] -
                                                 pdata->threshold_falling);
-                                if (threshold_code > 0)
-                                        falling_threshold |=
-                                                threshold_code << 8 * i;
+                                falling_threshold |= threshold_code << 8 * i;
                         }
                 }
 
@@ -276,9 +245,7 @@ skip_calib_data:
                 writel(falling_threshold,
                                 data->base + reg->threshold_th1);
 
-                writel((reg->intclr_rise_mask << reg->intclr_rise_shift) |
-                        (reg->intclr_fall_mask << reg->intclr_fall_shift),
-                                data->base + reg->tmu_intclear);
+                exynos_tmu_clear_irqs(data);
 
                 /* if last threshold limit is also present */
                 i = pdata->max_trigger_level - 1;
@@ -286,10 +253,6 @@ skip_calib_data:
                                 (pdata->trigger_type[i] == HW_TRIP)) {
                         threshold_code = temp_to_code(data,
                                                 pdata->trigger_levels[i]);
-                        if (threshold_code < 0) {
-                                ret = threshold_code;
-                                goto out;
-                        }
                         if (i == EXYNOS_MAX_TRIGGER_PER_REG - 1) {
                                 /* 1-4 level to be assigned in th0 reg */
                                 rising_threshold &= ~(0xff << 8 * i);
@@ -325,7 +288,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
         struct exynos_tmu_data *data = platform_get_drvdata(pdev);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int con, interrupt_en, cal_val;
+        unsigned int con, interrupt_en;
 
         mutex_lock(&data->lock);
         clk_enable(data->clk);
@@ -335,15 +298,11 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
         if (pdata->test_mux)
                 con |= (pdata->test_mux << reg->test_mux_addr_shift);
 
-        if (pdata->reference_voltage) {
-                con &= ~(reg->buf_vref_sel_mask << reg->buf_vref_sel_shift);
-                con |= pdata->reference_voltage << reg->buf_vref_sel_shift;
-        }
+        con &= ~(EXYNOS_TMU_REF_VOLTAGE_MASK << EXYNOS_TMU_REF_VOLTAGE_SHIFT);
+        con |= pdata->reference_voltage << EXYNOS_TMU_REF_VOLTAGE_SHIFT;
 
-        if (pdata->gain) {
-                con &= ~(reg->buf_slope_sel_mask << reg->buf_slope_sel_shift);
-                con |= (pdata->gain << reg->buf_slope_sel_shift);
-        }
+        con &= ~(EXYNOS_TMU_BUF_SLOPE_SEL_MASK << EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT);
+        con |= (pdata->gain << EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT);
 
         if (pdata->noise_cancel_mode) {
                 con &= ~(reg->therm_trip_mode_mask <<
@@ -351,29 +310,8 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
                 con |= (pdata->noise_cancel_mode << reg->therm_trip_mode_shift);
         }
 
-        if (pdata->cal_mode == HW_MODE) {
-                con &= ~(reg->calib_mode_mask << reg->calib_mode_shift);
-                cal_val = 0;
-                switch (pdata->cal_type) {
-                case TYPE_TWO_POINT_TRIMMING:
-                        cal_val = 3;
-                        break;
-                case TYPE_ONE_POINT_TRIMMING_85:
-                        cal_val = 2;
-                        break;
-                case TYPE_ONE_POINT_TRIMMING_25:
-                        cal_val = 1;
-                        break;
-                case TYPE_NONE:
-                        break;
-                default:
-                        dev_err(&pdev->dev, "Invalid calibration type, using none\n");
-                }
-                con |= cal_val << reg->calib_mode_shift;
-        }
-
         if (on) {
-                con |= (1 << reg->core_en_shift);
+                con |= (1 << EXYNOS_TMU_CORE_EN_SHIFT);
                 interrupt_en =
                         pdata->trigger_enable[3] << reg->inten_rise3_shift |
                         pdata->trigger_enable[2] << reg->inten_rise2_shift |
@@ -383,7 +321,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on)
                         interrupt_en |=
                                 interrupt_en << reg->inten_fall0_shift;
         } else {
-                con &= ~(1 << reg->core_en_shift);
+                con &= ~(1 << EXYNOS_TMU_CORE_EN_SHIFT);
                 interrupt_en = 0; /* Disable all interrupts */
         }
         writel(interrupt_en, data->base + reg->tmu_inten);
@@ -404,8 +342,16 @@ static int exynos_tmu_read(struct exynos_tmu_data *data)
         clk_enable(data->clk);
 
         temp_code = readb(data->base + reg->tmu_cur_temp);
-        temp = code_to_temp(data, temp_code);
 
+        if (data->soc == SOC_ARCH_EXYNOS4210)
+                /* temp_code should range between 75 and 175 */
+                if (temp_code < 75 || temp_code > 175) {
+                        temp = -ENODATA;
+                        goto out;
+                }
+
+        temp = code_to_temp(data, temp_code);
+out:
         clk_disable(data->clk);
         mutex_unlock(&data->lock);
 
@@ -465,7 +411,7 @@ static void exynos_tmu_work(struct work_struct *work)
                         struct exynos_tmu_data, irq_work);
         struct exynos_tmu_platform_data *pdata = data->pdata;
         const struct exynos_tmu_registers *reg = pdata->registers;
-        unsigned int val_irq, val_type;
+        unsigned int val_type;
 
         if (!IS_ERR(data->clk_sec))
                 clk_enable(data->clk_sec);
@@ -483,9 +429,7 @@ static void exynos_tmu_work(struct work_struct *work)
         clk_enable(data->clk);
 
         /* TODO: take action based on particular interrupt */
-        val_irq = readl(data->base + reg->tmu_intstat);
-        /* clear the interrupts */
-        writel(val_irq, data->base + reg->tmu_intclear);
+        exynos_tmu_clear_irqs(data);
 
         clk_disable(data->clk);
         mutex_unlock(&data->lock);
diff --git a/drivers/thermal/samsung/exynos_tmu.h b/drivers/thermal/samsung/exynos_tmu.h
index 1b4a6444ea61..c58c7663a3fe 100644
--- a/drivers/thermal/samsung/exynos_tmu.h
+++ b/drivers/thermal/samsung/exynos_tmu.h
@@ -34,11 +34,6 @@ enum calibration_type {
         TYPE_NONE,
 };
 
-enum calibration_mode {
-        SW_MODE,
-        HW_MODE,
-};
-
 enum soc_type {
         SOC_ARCH_EXYNOS3250 = 1,
         SOC_ARCH_EXYNOS4210,
@@ -82,46 +77,19 @@ enum soc_type {
  * bitfields. The register validity, offsets and bitfield values may vary
  * slightly across different exynos SOC's.
  * @triminfo_data: register containing 2 pont trimming data
- * @triminfo_25_shift: shift bit of the 25 C trim value in triminfo_data reg.
- * @triminfo_85_shift: shift bit of the 85 C trim value in triminfo_data reg.
  * @triminfo_ctrl: trim info controller register.
- * @triminfo_reload_shift: shift of triminfo reload enable bit in triminfo_ctrl
-        reg.
+ * @triminfo_ctrl_count: the number of trim info controller register.
  * @tmu_ctrl: TMU main controller register.
  * @test_mux_addr_shift: shift bits of test mux address.
- * @buf_vref_sel_shift: shift bits of reference voltage in tmu_ctrl register.
- * @buf_vref_sel_mask: mask bits of reference voltage in tmu_ctrl register.
  * @therm_trip_mode_shift: shift bits of tripping mode in tmu_ctrl register.
  * @therm_trip_mode_mask: mask bits of tripping mode in tmu_ctrl register.
  * @therm_trip_en_shift: shift bits of tripping enable in tmu_ctrl register.
- * @buf_slope_sel_shift: shift bits of amplifier gain value in tmu_ctrl
-        register.
- * @buf_slope_sel_mask: mask bits of amplifier gain value in tmu_ctrl register.
- * @calib_mode_shift: shift bits of calibration mode value in tmu_ctrl
-        register.
- * @calib_mode_mask: mask bits of calibration mode value in tmu_ctrl
-        register.
- * @therm_trip_tq_en_shift: shift bits of thermal trip enable by TQ pin in
-        tmu_ctrl register.
- * @core_en_shift: shift bits of TMU core enable bit in tmu_ctrl register.
  * @tmu_status: register drescribing the TMU status.
  * @tmu_cur_temp: register containing the current temperature of the TMU.
- * @tmu_cur_temp_shift: shift bits of current temp value in tmu_cur_temp
-        register.
  * @threshold_temp: register containing the base threshold level.
  * @threshold_th0: Register containing first set of rising levels.
- * @threshold_th0_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th0_l1_shift: shift bits of level1 threshold temperature.
- * @threshold_th0_l2_shift: shift bits of level2 threshold temperature.
- * @threshold_th0_l3_shift: shift bits of level3 threshold temperature.
  * @threshold_th1: Register containing second set of rising levels.
- * @threshold_th1_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th1_l1_shift: shift bits of level1 threshold temperature.
- * @threshold_th1_l2_shift: shift bits of level2 threshold temperature.
- * @threshold_th1_l3_shift: shift bits of level3 threshold temperature.
  * @threshold_th2: Register containing third set of rising levels.
- * @threshold_th2_l0_shift: shift bits of level0 threshold temperature.
- * @threshold_th3: Register containing fourth set of rising levels.
  * @threshold_th3_l0_shift: shift bits of level0 threshold temperature.
  * @tmu_inten: register containing the different threshold interrupt
         enable bits.
@@ -130,68 +98,35 @@ enum soc_type {
  * @inten_rise2_shift: shift bits of rising 2 interrupt bits.
  * @inten_rise3_shift: shift bits of rising 3 interrupt bits.
  * @inten_fall0_shift: shift bits of falling 0 interrupt bits.
- * @inten_fall1_shift: shift bits of falling 1 interrupt bits.
- * @inten_fall2_shift: shift bits of falling 2 interrupt bits.
- * @inten_fall3_shift: shift bits of falling 3 interrupt bits.
  * @tmu_intstat: Register containing the interrupt status values.
  * @tmu_intclear: Register for clearing the raised interrupt status.
- * @intclr_fall_shift: shift bits for interrupt clear fall 0
- * @intclr_rise_shift: shift bits of all rising interrupt bits.
- * @intclr_rise_mask: mask bits of all rising interrupt bits.
- * @intclr_fall_mask: mask bits of all rising interrupt bits.
  * @emul_con: TMU emulation controller register.
  * @emul_temp_shift: shift bits of emulation temperature.
  * @emul_time_shift: shift bits of emulation time.
- * @emul_time_mask: mask bits of emulation time.
  * @tmu_irqstatus: register to find which TMU generated interrupts.
  * @tmu_pmin: register to get/set the Pmin value.
  */
 struct exynos_tmu_registers {
         u32     triminfo_data;
-        u32     triminfo_25_shift;
-        u32     triminfo_85_shift;
 
-        u32     triminfo_ctrl;
-        u32     triminfo_ctrl1;
-        u32     triminfo_reload_shift;
+        u32     triminfo_ctrl[MAX_TRIMINFO_CTRL_REG];
+        u32     triminfo_ctrl_count;
 
         u32     tmu_ctrl;
         u32     test_mux_addr_shift;
-        u32     buf_vref_sel_shift;
-        u32     buf_vref_sel_mask;
         u32     therm_trip_mode_shift;
         u32     therm_trip_mode_mask;
         u32     therm_trip_en_shift;
-        u32     buf_slope_sel_shift;
-        u32     buf_slope_sel_mask;
-        u32     calib_mode_shift;
-        u32     calib_mode_mask;
-        u32     therm_trip_tq_en_shift;
-        u32     core_en_shift;
 
         u32     tmu_status;
 
         u32     tmu_cur_temp;
-        u32     tmu_cur_temp_shift;
 
         u32     threshold_temp;
 
         u32     threshold_th0;
-        u32     threshold_th0_l0_shift;
-        u32     threshold_th0_l1_shift;
-        u32     threshold_th0_l2_shift;
-        u32     threshold_th0_l3_shift;
-
         u32     threshold_th1;
-        u32     threshold_th1_l0_shift;
-        u32     threshold_th1_l1_shift;
-        u32     threshold_th1_l2_shift;
-        u32     threshold_th1_l3_shift;
-
         u32     threshold_th2;
-        u32     threshold_th2_l0_shift;
-
-        u32     threshold_th3;
         u32     threshold_th3_l0_shift;
 
         u32     tmu_inten;
@@ -200,22 +135,14 @@ struct exynos_tmu_registers {
         u32     inten_rise2_shift;
         u32     inten_rise3_shift;
         u32     inten_fall0_shift;
-        u32     inten_fall1_shift;
-        u32     inten_fall2_shift;
-        u32     inten_fall3_shift;
 
         u32     tmu_intstat;
 
         u32     tmu_intclear;
-        u32     intclr_fall_shift;
-        u32     intclr_rise_shift;
-        u32     intclr_fall_mask;
-        u32     intclr_rise_mask;
 
         u32     emul_con;
         u32     emul_temp_shift;
         u32     emul_time_shift;
-        u32     emul_time_mask;
 
         u32     tmu_irqstatus;
         u32     tmu_pmin;
@@ -250,11 +177,12 @@ struct exynos_tmu_registers {
  *      1 = enable trigger_level[] interrupt,
  *      0 = disable trigger_level[] interrupt
  * @max_trigger_level: max trigger level supported by the TMU
+ * @non_hw_trigger_levels: number of defined non-hardware trigger levels
  * @gain: gain of amplifier in the positive-TC generator block
- *      0 <= gain <= 15
+ *      0 < gain <= 15
  * @reference_voltage: reference voltage of amplifier
  *      in the positive-TC generator block
- *      0 <= reference_voltage <= 31
+ *      0 < reference_voltage <= 31
  * @noise_cancel_mode: noise cancellation mode
  *      000, 100, 101, 110 and 111 can be different modes
  * @type: determines the type of SOC
@@ -265,8 +193,8 @@ struct exynos_tmu_registers {
  * @second_point_trim: temp value of the second point trimming
  * @default_temp_offset: default temperature offset in case of no trimming
  * @test_mux; information if SoC supports test MUX
+ * @triminfo_reload: reload value to read TRIMINFO register
  * @cal_type: calibration type for temperature
- * @cal_mode: calibration mode for temperature
  * @freq_clip_table: Table representing frequency reduction percentage.
  * @freq_tab_count: Count of the above table as frequency reduction may
  *      applicable to only some of the trigger levels.
@@ -284,6 +212,7 @@ struct exynos_tmu_platform_data {
         enum trigger_type trigger_type[MAX_TRIP_COUNT];
         bool trigger_enable[MAX_TRIP_COUNT];
         u8 max_trigger_level;
+        u8 non_hw_trigger_levels;
         u8 gain;
         u8 reference_voltage;
         u8 noise_cancel_mode;
@@ -295,9 +224,9 @@ struct exynos_tmu_platform_data {
         u8 second_point_trim;
         u8 default_temp_offset;
         u8 test_mux;
+        u8 triminfo_reload[MAX_TRIMINFO_CTRL_REG];
 
         enum calibration_type cal_type;
-        enum calibration_mode cal_mode;
         enum soc_type type;
         struct freq_clip_table freq_tab[4];
         unsigned int freq_tab_count;
diff --git a/drivers/thermal/samsung/exynos_tmu_data.c b/drivers/thermal/samsung/exynos_tmu_data.c
index aa8e0dee2055..1724f6cdaef8 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.c
+++ b/drivers/thermal/samsung/exynos_tmu_data.c
@@ -27,14 +27,7 @@
 #if defined(CONFIG_CPU_EXYNOS4210)
 static const struct exynos_tmu_registers exynos4210_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_temp = EXYNOS4210_TMU_REG_THRESHOLD_TEMP,
@@ -46,7 +39,6 @@ static const struct exynos_tmu_registers exynos4210_tmu_registers = {
         .inten_rise3_shift = EXYNOS_TMU_INTEN_RISE3_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_rise_mask = EXYNOS4210_TMU_TRIG_LEVEL_MASK,
 };
 
 struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
@@ -64,6 +56,7 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
                 .trigger_type[1] = THROTTLE_ACTIVE,
                 .trigger_type[2] = SW_TRIP,
                 .max_trigger_level = 4,
+                .non_hw_trigger_levels = 3,
                 .gain = 15,
                 .reference_voltage = 7,
                 .cal_type = TYPE_ONE_POINT_TRIMMING,
@@ -93,18 +86,14 @@ struct exynos_tmu_init_data const exynos4210_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS3250)
 static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
+        .triminfo_ctrl[0] = EXYNOS_TMU_TRIMINFO_CON1,
+        .triminfo_ctrl[1] = EXYNOS_TMU_TRIMINFO_CON2,
+        .triminfo_ctrl_count = 2,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -116,14 +105,9 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define EXYNOS3250_TMU_DATA \
@@ -141,6 +125,7 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -160,8 +145,10 @@ static const struct exynos_tmu_registers exynos3250_tmu_registers = {
                 .temp_level = 95, \
         }, \
         .freq_tab_count = 2, \
+        .triminfo_reload[0] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
+        .triminfo_reload[1] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
         .registers = &exynos3250_tmu_registers, \
-        .features = (TMU_SUPPORT_EMULATION | \
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
                         TMU_SUPPORT_EMUL_TIME)
 #endif
@@ -182,20 +169,13 @@ struct exynos_tmu_init_data const exynos3250_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS4412) || defined(CONFIG_SOC_EXYNOS5250)
 static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
-        .triminfo_ctrl = EXYNOS_TMU_TRIMINFO_CON,
-        .triminfo_reload_shift = EXYNOS_TRIMINFO_RELOAD_SHIFT,
+        .triminfo_ctrl[0] = EXYNOS_TMU_TRIMINFO_CON2,
+        .triminfo_ctrl_count = 1,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
         .test_mux_addr_shift = EXYNOS4412_MUX_ADDR_SHIFT,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -208,14 +188,9 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define EXYNOS4412_TMU_DATA \
@@ -233,6 +208,7 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -252,6 +228,7 @@ static const struct exynos_tmu_registers exynos4412_tmu_registers = {
                 .temp_level = 95, \
         }, \
         .freq_tab_count = 2, \
+        .triminfo_reload[0] = EXYNOS_TRIMINFO_RELOAD_ENABLE, \
         .registers = &exynos4412_tmu_registers, \
         .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
                         TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
@@ -286,18 +263,10 @@ struct exynos_tmu_init_data const exynos5250_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5260)
 static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .tmu_ctrl = EXYNOS_TMU_REG_CONTROL1,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -310,14 +279,9 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS5260_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS5260_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS5260_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS5260_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS5260_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define __EXYNOS5260_TMU_DATA   \
@@ -335,6 +299,7 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -359,9 +324,8 @@ static const struct exynos_tmu_registers exynos5260_tmu_registers = {
 #define EXYNOS5260_TMU_DATA \
         __EXYNOS5260_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5260, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME)
 
 struct exynos_tmu_init_data const exynos5260_default_tmu_data = {
         .tmu_data = {
@@ -378,17 +342,10 @@ struct exynos_tmu_init_data const exynos5260_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5420)
 static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .triminfo_data = EXYNOS_TMU_REG_TRIMINFO,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS_TMU_REG_CONTROL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS_TMU_REG_STATUS,
         .tmu_cur_temp = EXYNOS_TMU_REG_CURRENT_TEMP,
         .threshold_th0 = EXYNOS_THD_TEMP_RISE,
@@ -402,14 +359,9 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .inten_fall0_shift = EXYNOS_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS_TMU_REG_INTSTAT,
         .tmu_intclear = EXYNOS_TMU_REG_INTCLEAR,
-        .intclr_fall_shift = EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS_TMU_FALL_INT_MASK,
         .emul_con = EXYNOS_EMUL_CON,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
         .emul_time_shift = EXYNOS_EMUL_TIME_SHIFT,
-        .emul_time_mask = EXYNOS_EMUL_TIME_MASK,
 };
 
 #define __EXYNOS5420_TMU_DATA   \
@@ -427,6 +379,7 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
         .trigger_type[2] = SW_TRIP, \
         .trigger_type[3] = HW_TRIP, \
         .max_trigger_level = 4, \
+        .non_hw_trigger_levels = 3, \
         .gain = 8, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
@@ -451,16 +404,15 @@ static const struct exynos_tmu_registers exynos5420_tmu_registers = {
 #define EXYNOS5420_TMU_DATA \
         __EXYNOS5420_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5250, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME)
 
 #define EXYNOS5420_TMU_DATA_SHARED \
         __EXYNOS5420_TMU_DATA \
         .type = SOC_ARCH_EXYNOS5420_TRIMINFO, \
-        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_TRIM_RELOAD | \
-                        TMU_SUPPORT_FALLING_TRIP | TMU_SUPPORT_READY_STATUS | \
-                        TMU_SUPPORT_EMUL_TIME | TMU_SUPPORT_ADDRESS_MULTIPLE)
+        .features = (TMU_SUPPORT_EMULATION | TMU_SUPPORT_FALLING_TRIP | \
+                        TMU_SUPPORT_READY_STATUS | TMU_SUPPORT_EMUL_TIME | \
+                        TMU_SUPPORT_ADDRESS_MULTIPLE)
 
 struct exynos_tmu_init_data const exynos5420_default_tmu_data = {
         .tmu_data = {
@@ -477,19 +429,10 @@ struct exynos_tmu_init_data const exynos5420_default_tmu_data = {
 #if defined(CONFIG_SOC_EXYNOS5440)
 static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .triminfo_data = EXYNOS5440_TMU_S0_7_TRIM,
-        .triminfo_25_shift = EXYNOS_TRIMINFO_25_SHIFT,
-        .triminfo_85_shift = EXYNOS_TRIMINFO_85_SHIFT,
         .tmu_ctrl = EXYNOS5440_TMU_S0_7_CTRL,
-        .buf_vref_sel_shift = EXYNOS_TMU_REF_VOLTAGE_SHIFT,
-        .buf_vref_sel_mask = EXYNOS_TMU_REF_VOLTAGE_MASK,
         .therm_trip_mode_shift = EXYNOS_TMU_TRIP_MODE_SHIFT,
         .therm_trip_mode_mask = EXYNOS_TMU_TRIP_MODE_MASK,
         .therm_trip_en_shift = EXYNOS_TMU_THERM_TRIP_EN_SHIFT,
-        .buf_slope_sel_shift = EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT,
-        .buf_slope_sel_mask = EXYNOS_TMU_BUF_SLOPE_SEL_MASK,
-        .calib_mode_shift = EXYNOS_TMU_CALIB_MODE_SHIFT,
-        .calib_mode_mask = EXYNOS_TMU_CALIB_MODE_MASK,
-        .core_en_shift = EXYNOS_TMU_CORE_EN_SHIFT,
         .tmu_status = EXYNOS5440_TMU_S0_7_STATUS,
         .tmu_cur_temp = EXYNOS5440_TMU_S0_7_TEMP,
         .threshold_th0 = EXYNOS5440_TMU_S0_7_TH0,
@@ -504,10 +447,6 @@ static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .inten_fall0_shift = EXYNOS5440_TMU_INTEN_FALL0_SHIFT,
         .tmu_intstat = EXYNOS5440_TMU_S0_7_IRQ,
         .tmu_intclear = EXYNOS5440_TMU_S0_7_IRQ,
-        .intclr_fall_shift = EXYNOS5440_TMU_CLEAR_FALL_INT_SHIFT,
-        .intclr_rise_shift = EXYNOS5440_TMU_RISE_INT_SHIFT,
-        .intclr_rise_mask = EXYNOS5440_TMU_RISE_INT_MASK,
-        .intclr_fall_mask = EXYNOS5440_TMU_FALL_INT_MASK,
         .tmu_irqstatus = EXYNOS5440_TMU_IRQ_STATUS,
         .emul_con = EXYNOS5440_TMU_S0_7_DEBUG,
         .emul_temp_shift = EXYNOS_EMUL_DATA_SHIFT,
@@ -521,11 +460,11 @@ static const struct exynos_tmu_registers exynos5440_tmu_registers = {
         .trigger_type[0] = SW_TRIP, \
         .trigger_type[4] = HW_TRIP, \
         .max_trigger_level = 5, \
+        .non_hw_trigger_levels = 1, \
         .gain = 5, \
         .reference_voltage = 16, \
         .noise_cancel_mode = 4, \
         .cal_type = TYPE_ONE_POINT_TRIMMING, \
-        .cal_mode = 0, \
         .efuse_value = 0x5b2d, \
         .min_efuse_value = 16, \
         .max_efuse_value = 76, \
diff --git a/drivers/thermal/samsung/exynos_tmu_data.h b/drivers/thermal/samsung/exynos_tmu_data.h
index f0979e598491..63de598c9c2c 100644
--- a/drivers/thermal/samsung/exynos_tmu_data.h
+++ b/drivers/thermal/samsung/exynos_tmu_data.h
@@ -39,55 +39,31 @@
 #define EXYNOS_TMU_BUF_SLOPE_SEL_SHIFT  8
 #define EXYNOS_TMU_CORE_EN_SHIFT        0
 
+/* Exynos3250 specific registers */
+#define EXYNOS_TMU_TRIMINFO_CON1        0x10
+
 /* Exynos4210 specific registers */
 #define EXYNOS4210_TMU_REG_THRESHOLD_TEMP       0x44
 #define EXYNOS4210_TMU_REG_TRIG_LEVEL0  0x50
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL1  0x54
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL2  0x58
-#define EXYNOS4210_TMU_REG_TRIG_LEVEL3  0x5C
-#define EXYNOS4210_TMU_REG_PAST_TEMP0   0x60
-#define EXYNOS4210_TMU_REG_PAST_TEMP1   0x64
-#define EXYNOS4210_TMU_REG_PAST_TEMP2   0x68
-#define EXYNOS4210_TMU_REG_PAST_TEMP3   0x6C
-
-#define EXYNOS4210_TMU_TRIG_LEVEL0_MASK 0x1
-#define EXYNOS4210_TMU_TRIG_LEVEL1_MASK 0x10
-#define EXYNOS4210_TMU_TRIG_LEVEL2_MASK 0x100
-#define EXYNOS4210_TMU_TRIG_LEVEL3_MASK 0x1000
-#define EXYNOS4210_TMU_TRIG_LEVEL_MASK  0x1111
-#define EXYNOS4210_TMU_INTCLEAR_VAL     0x1111
-
-/* Exynos5250 and Exynos4412 specific registers */
-#define EXYNOS_TMU_TRIMINFO_CON 0x14
+
+/* Exynos5250, Exynos4412, Exynos3250 specific registers */
+#define EXYNOS_TMU_TRIMINFO_CON2        0x14
 #define EXYNOS_THD_TEMP_RISE            0x50
 #define EXYNOS_THD_TEMP_FALL            0x54
 #define EXYNOS_EMUL_CON         0x80
 
-#define EXYNOS_TRIMINFO_RELOAD_SHIFT    1
+#define EXYNOS_TRIMINFO_RELOAD_ENABLE   1
 #define EXYNOS_TRIMINFO_25_SHIFT        0
 #define EXYNOS_TRIMINFO_85_SHIFT        8
-#define EXYNOS_TMU_RISE_INT_MASK        0x111
-#define EXYNOS_TMU_RISE_INT_SHIFT       0
-#define EXYNOS_TMU_FALL_INT_MASK        0x111
-#define EXYNOS_TMU_CLEAR_RISE_INT       0x111
-#define EXYNOS_TMU_CLEAR_FALL_INT       (0x111 << 12)
-#define EXYNOS_TMU_CLEAR_FALL_INT_SHIFT 12
-#define EXYNOS5420_TMU_CLEAR_FALL_INT_SHIFT     16
-#define EXYNOS5440_TMU_CLEAR_FALL_INT_SHIFT     4
 #define EXYNOS_TMU_TRIP_MODE_SHIFT      13
 #define EXYNOS_TMU_TRIP_MODE_MASK       0x7
 #define EXYNOS_TMU_THERM_TRIP_EN_SHIFT  12
-#define EXYNOS_TMU_CALIB_MODE_SHIFT     4
-#define EXYNOS_TMU_CALIB_MODE_MASK      0x3
 
 #define EXYNOS_TMU_INTEN_RISE0_SHIFT    0
 #define EXYNOS_TMU_INTEN_RISE1_SHIFT    4
 #define EXYNOS_TMU_INTEN_RISE2_SHIFT    8
 #define EXYNOS_TMU_INTEN_RISE3_SHIFT    12
 #define EXYNOS_TMU_INTEN_FALL0_SHIFT    16
-#define EXYNOS_TMU_INTEN_FALL1_SHIFT    20
-#define EXYNOS_TMU_INTEN_FALL2_SHIFT    24
-#define EXYNOS_TMU_INTEN_FALL3_SHIFT    28
 
 #define EXYNOS_EMUL_TIME        0x57F0
 #define EXYNOS_EMUL_TIME_MASK   0xffff
@@ -99,14 +75,9 @@
 #define EXYNOS_MAX_TRIGGER_PER_REG      4
 
 /* Exynos5260 specific */
-#define EXYNOS_TMU_REG_CONTROL1                 0x24
 #define EXYNOS5260_TMU_REG_INTEN                0xC0
 #define EXYNOS5260_TMU_REG_INTSTAT              0xC4
 #define EXYNOS5260_TMU_REG_INTCLEAR             0xC8
-#define EXYNOS5260_TMU_CLEAR_RISE_INT           0x1111
-#define EXYNOS5260_TMU_CLEAR_FALL_INT           (0x1111 << 16)
-#define EXYNOS5260_TMU_RISE_INT_MASK            0x1111
-#define EXYNOS5260_TMU_FALL_INT_MASK            0x1111
 #define EXYNOS5260_EMUL_CON                     0x100
 
 /* Exynos4412 specific */
@@ -122,29 +93,17 @@
 #define EXYNOS5440_TMU_S0_7_TH0                 0x110
 #define EXYNOS5440_TMU_S0_7_TH1                 0x130
 #define EXYNOS5440_TMU_S0_7_TH2                 0x150
-#define EXYNOS5440_TMU_S0_7_EVTEN               0x1F0
 #define EXYNOS5440_TMU_S0_7_IRQEN               0x210
 #define EXYNOS5440_TMU_S0_7_IRQ                 0x230
 /* exynos5440 common registers */
 #define EXYNOS5440_TMU_IRQ_STATUS               0x000
 #define EXYNOS5440_TMU_PMIN                     0x004
-#define EXYNOS5440_TMU_TEMP                     0x008
 
-#define EXYNOS5440_TMU_RISE_INT_MASK            0xf
-#define EXYNOS5440_TMU_RISE_INT_SHIFT           0
-#define EXYNOS5440_TMU_FALL_INT_MASK            0xf
 #define EXYNOS5440_TMU_INTEN_RISE0_SHIFT        0
 #define EXYNOS5440_TMU_INTEN_RISE1_SHIFT        1
 #define EXYNOS5440_TMU_INTEN_RISE2_SHIFT        2
 #define EXYNOS5440_TMU_INTEN_RISE3_SHIFT        3
 #define EXYNOS5440_TMU_INTEN_FALL0_SHIFT        4
-#define EXYNOS5440_TMU_INTEN_FALL1_SHIFT        5
-#define EXYNOS5440_TMU_INTEN_FALL2_SHIFT        6
-#define EXYNOS5440_TMU_INTEN_FALL3_SHIFT        7
-#define EXYNOS5440_TMU_TH_RISE0_SHIFT           0
-#define EXYNOS5440_TMU_TH_RISE1_SHIFT           8
-#define EXYNOS5440_TMU_TH_RISE2_SHIFT           16
-#define EXYNOS5440_TMU_TH_RISE3_SHIFT           24
 #define EXYNOS5440_TMU_TH_RISE4_SHIFT           24
 #define EXYNOS5440_EFUSE_SWAP_OFFSET            8
 
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 9bf10aa6069b..43b90709585f 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -1575,8 +1575,7 @@ struct thermal_zone_device *thermal_zone_device_register(const char *type,
 
         thermal_zone_device_update(tz);
 
-        if (!result)
-                return tz;
+        return tz;
 
 unregister:
         release_idr(&thermal_tz_idr, &thermal_idr_lock, tz->id);
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
index 89c4cee253e3..2e900a98c3e3 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -2413,12 +2413,17 @@ static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
 
         poll_wait(file, &tty->read_wait, wait);
         poll_wait(file, &tty->write_wait, wait);
+        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
+                mask |= POLLHUP;
         if (input_available_p(tty, 1))
                 mask |= POLLIN | POLLRDNORM;
+        else if (mask & POLLHUP) {
+                tty_flush_to_ldisc(tty);
+                if (input_available_p(tty, 1))
+                        mask |= POLLIN | POLLRDNORM;
+        }
         if (tty->packet && tty->link->ctrl_status)
                 mask |= POLLPRI | POLLIN | POLLRDNORM;
-        if (test_bit(TTY_OTHER_CLOSED, &tty->flags))
-                mask |= POLLHUP;
         if (tty_hung_up_p(file))
                 mask |= POLLHUP;
         if (!(mask & (POLLHUP | POLLIN | POLLRDNORM))) {
diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
index 8f37d57165ec..de7aae523b37 100644
--- a/drivers/tty/serial/8250/8250_mtk.c
+++ b/drivers/tty/serial/8250/8250_mtk.c
@@ -81,7 +81,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
                 /* Set to highest baudrate supported */
                 if (baud >= 1152000)
                         baud = 921600;
-                quot = DIV_ROUND_CLOSEST(port->uartclk, 256 * baud);
+                quot = (port->uartclk / (256 * baud)) + 1;
         }
 
         /*
diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
index 8bc2563335ae..56982da4a9e9 100644
--- a/drivers/tty/serial/of_serial.c
+++ b/drivers/tty/serial/of_serial.c
@@ -158,7 +158,7 @@ static int of_platform_serial_probe(struct platform_device *ofdev)
         if (of_find_property(ofdev->dev.of_node, "used-by-rtas", NULL))
                 return -EBUSY;
 
-        info = kmalloc(sizeof(*info), GFP_KERNEL);
+        info = kzalloc(sizeof(*info), GFP_KERNEL);
         if (info == NULL)
                 return -ENOMEM;
 
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index df3a8c74358e..eaeb9a02c7fe 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -363,7 +363,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
                  * The spd_hi, spd_vhi, spd_shi, spd_warp kludge...
                  * Die! Die! Die!
                  */
-                if (baud == 38400)
+                if (try == 0 && baud == 38400)
                         baud = altbaud;
 
                 /*
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 16a2c0237dd6..0508a1d8e4cd 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -1709,6 +1709,8 @@ int tty_release(struct inode *inode, struct file *filp)
         int     pty_master, tty_closing, o_tty_closing, do_sleep;
         int     idx;
         char    buf[64];
+        long    timeout = 0;
+        int     once = 1;
 
         if (tty_paranoia_check(tty, inode, __func__))
                 return 0;
@@ -1789,11 +1791,18 @@ int tty_release(struct inode *inode, struct file *filp)
                 if (!do_sleep)
                         break;
 
-                printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
-                                __func__, tty_name(tty, buf));
+                if (once) {
+                        once = 0;
+                        printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
+                               __func__, tty_name(tty, buf));
+                }
                 tty_unlock_pair(tty, o_tty);
                 mutex_unlock(&tty_mutex);
-                schedule();
+                schedule_timeout_killable(timeout);
+                if (timeout < 120 * HZ)
+                        timeout = 2 * timeout + 1;
+                else
+                        timeout = MAX_SCHEDULE_TIMEOUT;
         }
 
         /*
diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
index 610b720d3b91..59b25e039968 100644
--- a/drivers/tty/vt/consolemap.c
+++ b/drivers/tty/vt/consolemap.c
@@ -539,6 +539,12 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
 
         /* Save original vc_unipagdir_loc in case we allocate a new one */
         p = *vc->vc_uni_pagedir_loc;
+
+        if (!p) {
+                err = -EINVAL;
+
+                goto out_unlock;
+        }
         
         if (p->refcount > 1) {
                 int j, k;
@@ -623,6 +629,7 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
                 set_inverse_transl(vc, p, i); /* Update inverse translations */
         set_inverse_trans_unicode(vc, p);
 
+out_unlock:
         console_unlock();
         return err;
 }
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 3df5005c554d..9bdc6bd73432 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -742,7 +742,6 @@ static int ci_hdrc_remove(struct platform_device *pdev)
         ci_role_destroy(ci);
         ci_hdrc_enter_lpm(ci, true);
         usb_phy_shutdown(ci->transceiver);
-        kfree(ci->hw_bank.regmap);
 
         return 0;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index e934e19f49f5..077d58ac3dcb 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -60,6 +60,9 @@ static struct acm *acm_table[ACM_TTY_MINORS];
 
 static DEFINE_MUTEX(acm_table_lock);
 
+static void acm_tty_set_termios(struct tty_struct *tty,
+                                struct ktermios *termios_old);
+
 /*
  * acm_table accessors
  */
@@ -145,8 +148,15 @@ static int acm_ctrl_msg(struct acm *acm, int request, int value,
 /* devices aren't required to support these requests.
  * the cdc acm descriptor tells whether they do...
  */
-#define acm_set_control(acm, control) \
-        acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE, control, NULL, 0)
+static inline int acm_set_control(struct acm *acm, int control)
+{
+        if (acm->quirks & QUIRK_CONTROL_LINE_STATE)
+                return -EOPNOTSUPP;
+
+        return acm_ctrl_msg(acm, USB_CDC_REQ_SET_CONTROL_LINE_STATE,
+                        control, NULL, 0);
+}
+
 #define acm_set_line(acm, line) \
         acm_ctrl_msg(acm, USB_CDC_REQ_SET_LINE_CODING, 0, line, sizeof *(line))
 #define acm_send_break(acm, ms) \
@@ -554,6 +564,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
                 goto error_submit_urb;
         }
 
+        acm_tty_set_termios(tty, NULL);
+
         /*
          * Unthrottle device in case the TTY was closed while throttled.
          */
@@ -980,11 +992,12 @@ static void acm_tty_set_termios(struct tty_struct *tty,
         /* FIXME: Needs to clear unsupported bits in the termios */
         acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
 
-        if (!newline.dwDTERate) {
+        if (C_BAUD(tty) == B0) {
                 newline.dwDTERate = acm->line.dwDTERate;
                 newctrl &= ~ACM_CTRL_DTR;
-        } else
+        } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) {
                 newctrl |=  ACM_CTRL_DTR;
+        }
 
         if (newctrl != acm->ctrlout)
                 acm_set_control(acm, acm->ctrlout = newctrl);
@@ -1314,6 +1327,7 @@ made_compressed_probe:
         tty_port_init(&acm->port);
         acm->port.ops = &acm_port_ops;
         init_usb_anchor(&acm->delayed);
+        acm->quirks = quirks;
 
         buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
         if (!buf) {
@@ -1681,6 +1695,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
+        { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */
+        .driver_info = QUIRK_CONTROL_LINE_STATE, },
+        { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
         { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
         },
         /* Motorola H24 HSPA module: */
diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
index fc75651afe1c..d3251ebd09e2 100644
--- a/drivers/usb/class/cdc-acm.h
+++ b/drivers/usb/class/cdc-acm.h
@@ -121,6 +121,7 @@ struct acm {
         unsigned int throttle_req:1;                    /* throttle requested */
         u8 bInterval;
         struct usb_anchor delayed;                      /* writes queued for a device about to be woken */
+        unsigned long quirks;
 };
 
 #define CDC_DATA_INTERFACE_TYPE 0x0a
@@ -132,3 +133,4 @@ struct acm {
 #define NOT_A_MODEM                     BIT(3)
 #define NO_DATA_INTERFACE               BIT(4)
 #define IGNORE_DEVICE                   BIT(5)
+#define QUIRK_CONTROL_LINE_STATE        BIT(6)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index b84fb141e122..a6efb4184f2b 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2060,6 +2060,8 @@ int usb_alloc_streams(struct usb_interface *interface,
                 return -EINVAL;
         if (dev->speed != USB_SPEED_SUPER)
                 return -EINVAL;
+        if (dev->state < USB_STATE_CONFIGURED)
+                return -ENODEV;
 
         for (i = 0; i < num_eps; i++) {
                 /* Streams only apply to bulk endpoints. */
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 11e80ac31324..b649fef2e35d 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4468,9 +4468,6 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
         if (retval)
                 goto fail;
 
-        if (hcd->usb_phy && !hdev->parent)
-                usb_phy_notify_connect(hcd->usb_phy, udev->speed);
-
         /*
          * Some superspeed devices have finished the link training process
          * and attached to a superspeed hub port, but the device descriptor
@@ -4627,8 +4624,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
 
         /* Disconnect any existing devices under this port */
         if (udev) {
-                if (hcd->usb_phy && !hdev->parent &&
-                                !(portstatus & USB_PORT_STAT_CONNECTION))
+                if (hcd->usb_phy && !hdev->parent)
                         usb_phy_notify_disconnect(hcd->usb_phy, udev->speed);
                 usb_disconnect(&port_dev->child);
         }
@@ -4783,6 +4779,10 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
                                 port_dev->child = NULL;
                                 spin_unlock_irq(&device_state_lock);
                                 mutex_unlock(&usb_port_peer_mutex);
+                        } else {
+                                if (hcd->usb_phy && !hdev->parent)
+                                        usb_phy_notify_connect(hcd->usb_phy,
+                                                        udev->speed);
                         }
                 }
 
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 5ae883dc21f5..39b4081b632d 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -97,6 +97,12 @@ static const struct usb_device_id usb_quirk_list[] = {
         { USB_DEVICE(0x04f3, 0x0089), .driver_info =
                         USB_QUIRK_DEVICE_QUALIFIER },
 
+        { USB_DEVICE(0x04f3, 0x009b), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
+        { USB_DEVICE(0x04f3, 0x016f), .driver_info =
+                        USB_QUIRK_DEVICE_QUALIFIER },
+
         /* Roland SC-8820 */
         { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h
index bf015ab3b44c..55c90c53f2d6 100644
--- a/drivers/usb/dwc2/core.h
+++ b/drivers/usb/dwc2/core.h
@@ -619,7 +619,7 @@ struct dwc2_hsotg {
                         unsigned port_suspend_change:1;
                         unsigned port_over_current_change:1;
                         unsigned port_l1_change:1;
-                        unsigned reserved:26;
+                        unsigned reserved:25;
                 } b;
         } flags;
 
diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
index 7b5856fadd93..8b5c079c7b7d 100644
--- a/drivers/usb/dwc2/gadget.c
+++ b/drivers/usb/dwc2/gadget.c
@@ -2327,7 +2327,7 @@ irq_retry:
 
                 u32 usb_status = readl(hsotg->regs + GOTGCTL);
 
-                dev_info(hsotg->dev, "%s: USBRst\n", __func__);
+                dev_dbg(hsotg->dev, "%s: USBRst\n", __func__);
                 dev_dbg(hsotg->dev, "GNPTXSTS=%08x\n",
                         readl(hsotg->regs + GNPTXSTS));
 
@@ -2561,8 +2561,10 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
                         hs_ep->fifo_size = val;
                         break;
                 }
-                if (i == 8)
-                        return -ENOMEM;
+                if (i == 8) {
+                        ret = -ENOMEM;
+                        goto error;
+                }
         }
 
         /* for non control endpoints, set PID to D0 */
@@ -2579,6 +2581,7 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
         /* enable the endpoint interrupt */
         s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
 
+error:
         spin_unlock_irqrestore(&hsotg->lock, flags);
         return ret;
 }
@@ -2934,9 +2937,7 @@ static int s3c_hsotg_udc_stop(struct usb_gadget *gadget,
 
         spin_lock_irqsave(&hsotg->lock, flags);
 
-        if (!driver)
-                hsotg->driver = NULL;
-
+        hsotg->driver = NULL;
         hsotg->gadget.speed = USB_SPEED_UNKNOWN;
 
         spin_unlock_irqrestore(&hsotg->lock, flags);
@@ -3567,6 +3568,7 @@ static int s3c_hsotg_probe(struct platform_device *pdev)
                 s3c_hsotg_initep(hsotg, &hsotg->eps[epnum], epnum);
 
         /* disable power and clock */
+        s3c_hsotg_phy_disable(hsotg);
 
         ret = regulator_bulk_disable(ARRAY_SIZE(hsotg->supplies),
                                     hsotg->supplies);
@@ -3575,8 +3577,6 @@ static int s3c_hsotg_probe(struct platform_device *pdev)
                 goto err_ep_mem;
         }
 
-        s3c_hsotg_phy_disable(hsotg);
-
         ret = usb_add_gadget_udc(&pdev->dev, &hsotg->gadget);
         if (ret)
                 goto err_ep_mem;
diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c
index 2f537d588225..a0aa9f3da441 100644
--- a/drivers/usb/dwc3/dwc3-omap.c
+++ b/drivers/usb/dwc3/dwc3-omap.c
@@ -597,7 +597,7 @@ static int dwc3_omap_prepare(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
 
-        dwc3_omap_write_irqmisc_set(omap, 0x00);
+        dwc3_omap_disable_irqs(omap);
 
         return 0;
 }
@@ -605,19 +605,8 @@ static int dwc3_omap_prepare(struct device *dev)
 static void dwc3_omap_complete(struct device *dev)
 {
         struct dwc3_omap        *omap = dev_get_drvdata(dev);
-        u32                     reg;
 
-        reg = (USBOTGSS_IRQMISC_OEVT |
-                        USBOTGSS_IRQMISC_DRVVBUS_RISE |
-                        USBOTGSS_IRQMISC_CHRGVBUS_RISE |
-                        USBOTGSS_IRQMISC_DISCHRGVBUS_RISE |
-                        USBOTGSS_IRQMISC_IDPULLUP_RISE |
-                        USBOTGSS_IRQMISC_DRVVBUS_FALL |
-                        USBOTGSS_IRQMISC_CHRGVBUS_FALL |
-                        USBOTGSS_IRQMISC_DISCHRGVBUS_FALL |
-                        USBOTGSS_IRQMISC_IDPULLUP_FALL);
-
-        dwc3_omap_write_irqmisc_set(omap, reg);
+        dwc3_omap_enable_irqs(omap);
 }
 
 static int dwc3_omap_suspend(struct device *dev)
diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c
index 436fb08c40b8..a36cf66302fb 100644
--- a/drivers/usb/dwc3/dwc3-pci.c
+++ b/drivers/usb/dwc3/dwc3-pci.c
@@ -30,6 +30,7 @@
 #define PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3 0xabcd
 #define PCI_DEVICE_ID_INTEL_BYT         0x0f37
 #define PCI_DEVICE_ID_INTEL_MRFLD       0x119e
+#define PCI_DEVICE_ID_INTEL_BSW         0x22B7
 
 struct dwc3_pci {
         struct device           *dev;
@@ -181,6 +182,7 @@ static const struct pci_device_id dwc3_pci_id_table[] = {
                 PCI_DEVICE(PCI_VENDOR_ID_SYNOPSYS,
                                 PCI_DEVICE_ID_SYNOPSYS_HAPSUSB3),
         },
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BSW), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_BYT), },
         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_MRFLD), },
         {  }    /* Terminating Entry */
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index b35938777dde..711b23019d54 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -256,7 +256,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
 
         /* stall is always issued on EP0 */
         dep = dwc->eps[0];
-        __dwc3_gadget_ep_set_halt(dep, 1);
+        __dwc3_gadget_ep_set_halt(dep, 1, false);
         dep->flags = DWC3_EP_ENABLED;
         dwc->delayed_status = false;
 
@@ -271,7 +271,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
         dwc3_ep0_out_start(dwc);
 }
 
-int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
+int __dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
 {
         struct dwc3_ep                  *dep = to_dwc3_ep(ep);
         struct dwc3                     *dwc = dep->dwc;
@@ -281,6 +281,20 @@ int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
         return 0;
 }
 
+int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value)
+{
+        struct dwc3_ep                  *dep = to_dwc3_ep(ep);
+        struct dwc3                     *dwc = dep->dwc;
+        unsigned long                   flags;
+        int                             ret;
+
+        spin_lock_irqsave(&dwc->lock, flags);
+        ret = __dwc3_gadget_ep0_set_halt(ep, value);
+        spin_unlock_irqrestore(&dwc->lock, flags);
+
+        return ret;
+}
+
 void dwc3_ep0_out_start(struct dwc3 *dwc)
 {
         int                             ret;
@@ -466,7 +480,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
                                 return -EINVAL;
                         if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
                                 break;
-                        ret = __dwc3_gadget_ep_set_halt(dep, set);
+                        ret = __dwc3_gadget_ep_set_halt(dep, set, true);
                         if (ret)
                                 return -EINVAL;
                         break;
@@ -775,9 +789,6 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
         dwc->ep0_next_event = DWC3_EP0_NRDY_STATUS;
 
-        r = next_request(&ep0->request_list);
-        ur = &r->request;
-
         trb = dwc->ep0_trb;
 
         status = DWC3_TRB_SIZE_TRBSTS(trb->size);
@@ -790,6 +801,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
                 return;
         }
 
+        r = next_request(&ep0->request_list);
+        if (!r)
+                return;
+
+        ur = &r->request;
+
         length = trb->size & DWC3_TRB_SIZE_MASK;
 
         if (dwc->ep0_bounced) {
@@ -811,12 +828,19 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
 
                 dwc3_ep0_stall_and_restart(dwc);
         } else {
-                /*
-                 * handle the case where we have to send a zero packet. This
-                 * seems to be case when req.length > maxpacket. Could it be?
-                 */
-                if (r)
-                        dwc3_gadget_giveback(ep0, r, 0);
+                dwc3_gadget_giveback(ep0, r, 0);
+
+                if (IS_ALIGNED(ur->length, ep0->endpoint.maxpacket) &&
+                                ur->length && ur->zero) {
+                        int ret;
+
+                        dwc->ep0_next_event = DWC3_EP0_COMPLETE;
+
+                        ret = dwc3_ep0_start_trans(dwc, epnum,
+                                        dwc->ctrl_req_addr, 0,
+                                        DWC3_TRBCTL_CONTROL_DATA);
+                        WARN_ON(ret < 0);
+                }
         }
 }
 
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 3818b26bfc05..546ea5431b8c 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -525,12 +525,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
                 if (!usb_endpoint_xfer_isoc(desc))
                         return 0;
 
-                memset(&trb_link, 0, sizeof(trb_link));
-
                 /* Link TRB for ISOC. The HWO bit is never reset */
                 trb_st_hw = &dep->trb_pool[0];
 
                 trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1];
+                memset(trb_link, 0, sizeof(*trb_link));
 
                 trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
                 trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
@@ -581,7 +580,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
 
         /* make sure HW endpoint isn't stalled */
         if (dep->flags & DWC3_EP_STALL)
-                __dwc3_gadget_ep_set_halt(dep, 0);
+                __dwc3_gadget_ep_set_halt(dep, 0, false);
 
         reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
         reg &= ~DWC3_DALEPENA_EP(dep->number);
@@ -1202,15 +1201,28 @@ out0:
         return ret;
 }
 
-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
 {
         struct dwc3_gadget_ep_cmd_params        params;
         struct dwc3                             *dwc = dep->dwc;
         int                                     ret;
 
+        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
+                dev_err(dwc->dev, "%s is of Isochronous type\n", dep->name);
+                return -EINVAL;
+        }
+
         memset(&params, 0x00, sizeof(params));
 
         if (value) {
+                if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) ||
+                                (!list_empty(&dep->req_queued) ||
+                                 !list_empty(&dep->request_list)))) {
+                        dev_dbg(dwc->dev, "%s: pending request, cannot halt\n",
+                                        dep->name);
+                        return -EAGAIN;
+                }
+
                 ret = dwc3_send_gadget_ep_cmd(dwc, dep->number,
                         DWC3_DEPCMD_SETSTALL, &params);
                 if (ret)
@@ -1241,15 +1253,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value)
         int                             ret;
 
         spin_lock_irqsave(&dwc->lock, flags);
-
-        if (usb_endpoint_xfer_isoc(dep->endpoint.desc)) {
-                dev_err(dwc->dev, "%s is of Isochronous type\n", dep->name);
-                ret = -EINVAL;
-                goto out;
-        }
-
-        ret = __dwc3_gadget_ep_set_halt(dep, value);
-out:
+        ret = __dwc3_gadget_ep_set_halt(dep, value, false);
         spin_unlock_irqrestore(&dwc->lock, flags);
 
         return ret;
@@ -1260,15 +1264,18 @@ static int dwc3_gadget_ep_set_wedge(struct usb_ep *ep)
         struct dwc3_ep                  *dep = to_dwc3_ep(ep);
         struct dwc3                     *dwc = dep->dwc;
         unsigned long                   flags;
+        int                             ret;
 
         spin_lock_irqsave(&dwc->lock, flags);
         dep->flags |= DWC3_EP_WEDGE;
-        spin_unlock_irqrestore(&dwc->lock, flags);
 
         if (dep->number == 0 || dep->number == 1)
-                return dwc3_gadget_ep0_set_halt(ep, 1);
+                ret = __dwc3_gadget_ep0_set_halt(ep, 1);
         else
-                return dwc3_gadget_ep_set_halt(ep, 1);
+                ret = __dwc3_gadget_ep_set_halt(dep, 1, false);
+        spin_unlock_irqrestore(&dwc->lock, flags);
+
+        return ret;
 }
 
 /* -------------------------------------------------------------------------- */
diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
index 178ad8982206..18ae3eaa8b6f 100644
--- a/drivers/usb/dwc3/gadget.h
+++ b/drivers/usb/dwc3/gadget.h
@@ -82,10 +82,11 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req,
 void dwc3_ep0_interrupt(struct dwc3 *dwc,
                 const struct dwc3_event_depevt *event);
 void dwc3_ep0_out_start(struct dwc3 *dwc);
+int __dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_set_halt(struct usb_ep *ep, int value);
 int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
                 gfp_t gfp_flags);
-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value);
+int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol);
 
 /**
  * dwc3_gadget_ep_get_transfer_index - Gets transfer index from HW
diff --git a/drivers/usb/dwc3/trace.h b/drivers/usb/dwc3/trace.h
index 78aff1da089a..60b0f41eafc4 100644
--- a/drivers/usb/dwc3/trace.h
+++ b/drivers/usb/dwc3/trace.h
@@ -73,15 +73,23 @@ DECLARE_EVENT_CLASS(dwc3_log_ctrl,
         TP_PROTO(struct usb_ctrlrequest *ctrl),
         TP_ARGS(ctrl),
         TP_STRUCT__entry(
-                __field(struct usb_ctrlrequest *, ctrl)
+                __field(__u8, bRequestType)
+                __field(__u8, bRequest)
+                __field(__le16, wValue)
+                __field(__le16, wIndex)
+                __field(__le16, wLength)
         ),
         TP_fast_assign(
-                __entry->ctrl = ctrl;
+                __entry->bRequestType = ctrl->bRequestType;
+                __entry->bRequest = ctrl->bRequest;
+                __entry->wValue = ctrl->wValue;
+                __entry->wIndex = ctrl->wIndex;
+                __entry->wLength = ctrl->wLength;
         ),
         TP_printk("bRequestType %02x bRequest %02x wValue %04x wIndex %04x wLength %d",
-                __entry->ctrl->bRequestType, __entry->ctrl->bRequest,
-                le16_to_cpu(__entry->ctrl->wValue), le16_to_cpu(__entry->ctrl->wIndex),
-                le16_to_cpu(__entry->ctrl->wLength)
+                __entry->bRequestType, __entry->bRequest,
+                le16_to_cpu(__entry->wValue), le16_to_cpu(__entry->wIndex),
+                le16_to_cpu(__entry->wLength)
         )
 );
 
@@ -94,15 +102,22 @@ DECLARE_EVENT_CLASS(dwc3_log_request,
         TP_PROTO(struct dwc3_request *req),
         TP_ARGS(req),
         TP_STRUCT__entry(
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(struct dwc3_request *, req)
+                __field(unsigned, actual)
+                __field(unsigned, length)
+                __field(int, status)
         ),
         TP_fast_assign(
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", req->dep->name);
                 __entry->req = req;
+                __entry->actual = req->request.actual;
+                __entry->length = req->request.length;
+                __entry->status = req->request.status;
         ),
         TP_printk("%s: req %p length %u/%u ==> %d",
-                __entry->req->dep->name, __entry->req,
-                __entry->req->request.actual, __entry->req->request.length,
-                __entry->req->request.status
+                __get_str(name), __entry->req, __entry->actual, __entry->length,
+                __entry->status
         )
 );
 
@@ -158,17 +173,17 @@ DECLARE_EVENT_CLASS(dwc3_log_gadget_ep_cmd,
                 struct dwc3_gadget_ep_cmd_params *params),
         TP_ARGS(dep, cmd, params),
         TP_STRUCT__entry(
-                __field(struct dwc3_ep *, dep)
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(unsigned int, cmd)
                 __field(struct dwc3_gadget_ep_cmd_params *, params)
         ),
         TP_fast_assign(
-                __entry->dep = dep;
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", dep->name);
                 __entry->cmd = cmd;
                 __entry->params = params;
         ),
         TP_printk("%s: cmd '%s' [%d] params %08x %08x %08x\n",
-                __entry->dep->name, dwc3_gadget_ep_cmd_string(__entry->cmd),
+                __get_str(name), dwc3_gadget_ep_cmd_string(__entry->cmd),
                 __entry->cmd, __entry->params->param0,
                 __entry->params->param1, __entry->params->param2
         )
@@ -184,16 +199,24 @@ DECLARE_EVENT_CLASS(dwc3_log_trb,
         TP_PROTO(struct dwc3_ep *dep, struct dwc3_trb *trb),
         TP_ARGS(dep, trb),
         TP_STRUCT__entry(
-                __field(struct dwc3_ep *, dep)
+                __dynamic_array(char, name, DWC3_MSG_MAX)
                 __field(struct dwc3_trb *, trb)
+                __field(u32, bpl)
+                __field(u32, bph)
+                __field(u32, size)
+                __field(u32, ctrl)
         ),
         TP_fast_assign(
-                __entry->dep = dep;
+                snprintf(__get_str(name), DWC3_MSG_MAX, "%s", dep->name);
                 __entry->trb = trb;
+                __entry->bpl = trb->bpl;
+                __entry->bph = trb->bph;
+                __entry->size = trb->size;
+                __entry->ctrl = trb->ctrl;
         ),
         TP_printk("%s: trb %p bph %08x bpl %08x size %08x ctrl %08x\n",
-                __entry->dep->name, __entry->trb, __entry->trb->bph,
-                __entry->trb->bpl, __entry->trb->size, __entry->trb->ctrl
+                __get_str(name), __entry->trb, __entry->bph, __entry->bpl,
+                __entry->size, __entry->ctrl
         )
 );
 
diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index a8c18df171c3..f6a51fddd5b5 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -560,7 +560,7 @@ static int bos_desc(struct usb_composite_dev *cdev)
         usb_ext->bLength = USB_DT_USB_EXT_CAP_SIZE;
         usb_ext->bDescriptorType = USB_DT_DEVICE_CAPABILITY;
         usb_ext->bDevCapabilityType = USB_CAP_TYPE_EXT;
-        usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT);
+        usb_ext->bmAttributes = cpu_to_le32(USB_LPM_SUPPORT | USB_BESL_SUPPORT);
 
         /*
          * The Superspeed USB Capability descriptor shall be implemented by all
diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c
index 6da4685490ef..aad8165e98ef 100644
--- a/drivers/usb/gadget/function/f_acm.c
+++ b/drivers/usb/gadget/function/f_acm.c
@@ -433,12 +433,12 @@ static int acm_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
                         dev_vdbg(&cdev->gadget->dev,
                                  "reset acm control interface %d\n", intf);
                         usb_ep_disable(acm->notify);
-                } else {
-                        dev_vdbg(&cdev->gadget->dev,
-                                 "init acm ctrl interface %d\n", intf);
+                }
+
+                if (!acm->notify->desc)
                         if (config_ep_by_speed(cdev->gadget, f, acm->notify))
                                 return -EINVAL;
-                }
+
                 usb_ep_enable(acm->notify);
                 acm->notify->driver_data = acm;
 
diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index 4d8b236ea608..c9e90de5bdd9 100644
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -325,7 +325,6 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         if (eem->port.out_ep)
                 eem->port.out_ep->driver_data = NULL;
         if (eem->port.in_ep)
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 7c6771d027a2..63314ede7ba6 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -647,15 +647,26 @@ static void ffs_user_copy_worker(struct work_struct *work)
         if (io_data->read && ret > 0) {
                 int i;
                 size_t pos = 0;
+
+                /*
+                 * Since req->length may be bigger than io_data->len (after
+                 * being rounded up to maxpacketsize), we may end up with more
+                 * data then user space has space for.
+                 */
+                ret = min_t(int, ret, io_data->len);
+
                 use_mm(io_data->mm);
                 for (i = 0; i < io_data->nr_segs; i++) {
+                        size_t len = min_t(size_t, ret - pos,
+                                        io_data->iovec[i].iov_len);
+                        if (!len)
+                                break;
                         if (unlikely(copy_to_user(io_data->iovec[i].iov_base,
-                                                 &io_data->buf[pos],
-                                                 io_data->iovec[i].iov_len))) {
+                                                 &io_data->buf[pos], len))) {
                                 ret = -EFAULT;
                                 break;
                         }
-                        pos += io_data->iovec[i].iov_len;
+                        pos += len;
                 }
                 unuse_mm(io_data->mm);
         }
@@ -687,7 +698,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
         struct ffs_epfile *epfile = file->private_data;
         struct ffs_ep *ep;
         char *data = NULL;
-        ssize_t ret, data_len;
+        ssize_t ret, data_len = -EINVAL;
         int halt;
 
         /* Are we still active? */
@@ -787,13 +798,30 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
                 /* Fire the request */
                 struct usb_request *req;
 
+                /*
+                 * Sanity Check: even though data_len can't be used
+                 * uninitialized at the time I write this comment, some
+                 * compilers complain about this situation.
+                 * In order to keep the code clean from warnings, data_len is
+                 * being initialized to -EINVAL during its declaration, which
+                 * means we can't rely on compiler anymore to warn no future
+                 * changes won't result in data_len being used uninitialized.
+                 * For such reason, we're adding this redundant sanity check
+                 * here.
+                 */
+                if (unlikely(data_len == -EINVAL)) {
+                        WARN(1, "%s: data_len == -EINVAL\n", __func__);
+                        ret = -EINVAL;
+                        goto error_lock;
+                }
+
                 if (io_data->aio) {
                         req = usb_ep_alloc_request(ep->ep, GFP_KERNEL);
                         if (unlikely(!req))
                                 goto error_lock;
 
                         req->buf      = data;
-                        req->length   = io_data->len;
+                        req->length   = data_len;
 
                         io_data->buf = data;
                         io_data->ep = ep->ep;
@@ -815,7 +843,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
 
                         req = ep->req;
                         req->buf      = data;
-                        req->length   = io_data->len;
+                        req->length   = data_len;
 
                         req->context  = &done;
                         req->complete = ffs_epfile_io_complete;
@@ -2663,8 +2691,6 @@ static inline struct f_fs_opts *ffs_do_functionfs_bind(struct usb_function *f,
         func->conf = c;
         func->gadget = c->cdev->gadget;
 
-        ffs_data_get(func->ffs);
-
         /*
          * in drivers/usb/gadget/configfs.c:configfs_composite_bind()
          * configurations are bound in sequence with list_for_each_entry,
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index a95290a1289f..59ab62c92b66 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -621,12 +621,14 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
         dev = MKDEV(major, hidg->minor);
         status = cdev_add(&hidg->cdev, dev, 1);
         if (status)
-                goto fail;
+                goto fail_free_descs;
 
         device_create(hidg_class, NULL, dev, NULL, "%s%d", "hidg", hidg->minor);
 
         return 0;
 
+fail_free_descs:
+        usb_free_all_descriptors(f);
 fail:
         ERROR(f->config->cdev, "hidg_bind FAILED\n");
         if (hidg->req != NULL) {
@@ -635,7 +637,6 @@ fail:
                         usb_ep_free_request(hidg->in_ep, hidg->req);
         }
 
-        usb_free_all_descriptors(f);
         return status;
 }
 
diff --git a/drivers/usb/gadget/function/f_loopback.c b/drivers/usb/gadget/function/f_loopback.c
index bf04389137e6..298b46112b1a 100644
--- a/drivers/usb/gadget/function/f_loopback.c
+++ b/drivers/usb/gadget/function/f_loopback.c
@@ -253,22 +253,13 @@ static void loopback_complete(struct usb_ep *ep, struct usb_request *req)
 
         case 0:                         /* normal completion? */
                 if (ep == loop->out_ep) {
-                        /* loop this OUT packet back IN to the host */
                         req->zero = (req->actual < req->length);
                         req->length = req->actual;
-                        status = usb_ep_queue(loop->in_ep, req, GFP_ATOMIC);
-                        if (status == 0)
-                                return;
-
-                        /* "should never get here" */
-                        ERROR(cdev, "can't loop %s to %s: %d\n",
-                                ep->name, loop->in_ep->name,
-                                status);
                 }
 
                 /* queue the buffer for some later OUT packet */
                 req->length = buflen;
-                status = usb_ep_queue(loop->out_ep, req, GFP_ATOMIC);
+                status = usb_ep_queue(ep, req, GFP_ATOMIC);
                 if (status == 0)
                         return;
 
@@ -308,60 +299,66 @@ static inline struct usb_request *lb_alloc_ep_req(struct usb_ep *ep, int len)
         return alloc_ep_req(ep, len, buflen);
 }
 
-static int
-enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+static int enable_endpoint(struct usb_composite_dev *cdev, struct f_loopback *loop,
+                struct usb_ep *ep)
 {
-        int                                     result = 0;
-        struct usb_ep                           *ep;
         struct usb_request                      *req;
         unsigned                                i;
+        int                                     result;
 
-        /* one endpoint writes data back IN to the host */
-        ep = loop->in_ep;
+        /*
+         * one endpoint writes data back IN to the host while another endpoint
+         * just reads OUT packets
+         */
         result = config_ep_by_speed(cdev->gadget, &(loop->function), ep);
         if (result)
-                return result;
+                goto fail0;
         result = usb_ep_enable(ep);
         if (result < 0)
-                return result;
-        ep->driver_data = loop;
-
-        /* one endpoint just reads OUT packets */
-        ep = loop->out_ep;
-        result = config_ep_by_speed(cdev->gadget, &(loop->function), ep);
-        if (result)
                 goto fail0;
-
-        result = usb_ep_enable(ep);
-        if (result < 0) {
-fail0:
-                ep = loop->in_ep;
-                usb_ep_disable(ep);
-                ep->driver_data = NULL;
-                return result;
-        }
         ep->driver_data = loop;
 
-        /* allocate a bunch of read buffers and queue them all at once.
+        /*
+         * allocate a bunch of read buffers and queue them all at once.
          * we buffer at most 'qlen' transfers; fewer if any need more
          * than 'buflen' bytes each.
          */
         for (i = 0; i < qlen && result == 0; i++) {
                 req = lb_alloc_ep_req(ep, 0);
-                if (req) {
-                        req->complete = loopback_complete;
-                        result = usb_ep_queue(ep, req, GFP_ATOMIC);
-                        if (result)
-                                ERROR(cdev, "%s queue req --> %d\n",
-                                                ep->name, result);
-                } else {
-                        usb_ep_disable(ep);
-                        ep->driver_data = NULL;
-                        result = -ENOMEM;
-                        goto fail0;
+                if (!req)
+                        goto fail1;
+
+                req->complete = loopback_complete;
+                result = usb_ep_queue(ep, req, GFP_ATOMIC);
+                if (result) {
+                        ERROR(cdev, "%s queue req --> %d\n",
+                                        ep->name, result);
+                        goto fail1;
                 }
         }
 
+        return 0;
+
+fail1:
+        usb_ep_disable(ep);
+
+fail0:
+        return result;
+}
+
+static int
+enable_loopback(struct usb_composite_dev *cdev, struct f_loopback *loop)
+{
+        int                                     result = 0;
+
+        result = enable_endpoint(cdev, loop, loop->in_ep);
+        if (result)
+                return result;
+
+        result = enable_endpoint(cdev, loop, loop->out_ep);
+        if (result)
+                return result;
+
         DBG(cdev, "%s enabled\n", loop->function.name);
         return result;
 }
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 146f48cc65d7..16361b0a8b46 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1461,7 +1461,6 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         if (ncm->notify_req) {
                 kfree(ncm->notify_req->buf);
                 usb_ep_free_request(ncm->notify, ncm->notify_req);
diff --git a/drivers/usb/gadget/function/f_obex.c b/drivers/usb/gadget/function/f_obex.c
index 5f40080c92cc..a1b79c53499c 100644
--- a/drivers/usb/gadget/function/f_obex.c
+++ b/drivers/usb/gadget/function/f_obex.c
@@ -35,6 +35,7 @@ struct f_obex {
         struct gserial                  port;
         u8                              ctrl_id;
         u8                              data_id;
+        u8                              cur_alt;
         u8                              port_num;
         u8                              can_activate;
 };
@@ -235,6 +236,8 @@ static int obex_set_alt(struct usb_function *f, unsigned intf, unsigned alt)
         } else
                 goto fail;
 
+        obex->cur_alt = alt;
+
         return 0;
 
 fail:
@@ -245,10 +248,7 @@ static int obex_get_alt(struct usb_function *f, unsigned intf)
 {
         struct f_obex           *obex = func_to_obex(f);
 
-        if (intf == obex->ctrl_id)
-                return 0;
-
-        return obex->port.in->driver_data ? 1 : 0;
+        return obex->cur_alt;
 }
 
 static void obex_disable(struct usb_function *f)
@@ -397,7 +397,6 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (obex->port.out)
                 obex->port.out->driver_data = NULL;
diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b9cfc1571d71..1ec8b7ffdccd 100644
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -570,8 +570,8 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
 err_req:
         for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
                 usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
-err:
         usb_free_all_descriptors(f);
+err:
         if (fp->out_ep)
                 fp->out_ep->driver_data = NULL;
         if (fp->in_ep)
diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index ddb09dc6d1f2..f13fc6a58565 100644
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -802,8 +802,10 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
 
         if (rndis->manufacturer && rndis->vendorID &&
                         rndis_set_param_vendor(rndis->config, rndis->vendorID,
-                                               rndis->manufacturer))
-                goto fail;
+                                               rndis->manufacturer)) {
+                status = -EINVAL;
+                goto fail_free_descs;
+        }
 
         /* NOTE:  all that is done without knowing or caring about
          * the network link ... which is unavailable to this code
@@ -817,10 +819,11 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                         rndis->notify->name);
         return 0;
 
+fail_free_descs:
+        usb_free_all_descriptors(f);
 fail:
         kfree(f->os_desc_table);
         f->os_desc_n = 0;
-        usb_free_all_descriptors(f);
 
         if (rndis->notify_req) {
                 kfree(rndis->notify_req->buf);
diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c
index 1ea8baf33333..e3dfa675ff06 100644
--- a/drivers/usb/gadget/function/f_subset.c
+++ b/drivers/usb/gadget/function/f_subset.c
@@ -380,7 +380,6 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
         return 0;
 
 fail:
-        usb_free_all_descriptors(f);
         /* we might as well release our claims on endpoints */
         if (geth->port.out_ep)
                 geth->port.out_ep->driver_data = NULL;
diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index a5a27a504d67..33e16658e5cf 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -512,6 +512,11 @@ static int snd_uac2_remove(struct platform_device *pdev)
         return 0;
 }
 
+static void snd_uac2_release(struct device *dev)
+{
+        dev_dbg(dev, "releasing '%s'\n", dev_name(dev));
+}
+
 static int alsa_uac2_init(struct audio_dev *agdev)
 {
         struct snd_uac2_chip *uac2 = &agdev->uac2;
@@ -523,6 +528,7 @@ static int alsa_uac2_init(struct audio_dev *agdev)
 
         uac2->pdev.id = 0;
         uac2->pdev.name = uac2_name;
+        uac2->pdev.dev.release = snd_uac2_release;
 
         /* Register snd_uac2 driver */
         err = platform_driver_register(&uac2->pdrv);
@@ -772,6 +778,7 @@ struct usb_endpoint_descriptor fs_epout_desc = {
 
         .bEndpointAddress = USB_DIR_OUT,
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1023),
         .bInterval = 1,
 };
 
@@ -780,6 +787,7 @@ struct usb_endpoint_descriptor hs_epout_desc = {
         .bDescriptorType = USB_DT_ENDPOINT,
 
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1024),
         .bInterval = 4,
 };
 
@@ -847,6 +855,7 @@ struct usb_endpoint_descriptor fs_epin_desc = {
 
         .bEndpointAddress = USB_DIR_IN,
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1023),
         .bInterval = 1,
 };
 
@@ -855,6 +864,7 @@ struct usb_endpoint_descriptor hs_epin_desc = {
         .bDescriptorType = USB_DT_ENDPOINT,
 
         .bmAttributes = USB_ENDPOINT_XFER_ISOC | USB_ENDPOINT_SYNC_ASYNC,
+        .wMaxPacketSize = cpu_to_le16(1024),
         .bInterval = 4,
 };
 
@@ -947,6 +957,9 @@ free_ep(struct uac2_rtd_params *prm, struct usb_ep *ep)
         struct snd_uac2_chip *uac2 = prm->uac2;
         int i;
 
+        if (!prm->ep_enabled)
+                return;
+
         prm->ep_enabled = false;
 
         for (i = 0; i < USB_XFERS; i++) {
@@ -1071,7 +1084,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
         if (!prm->rbuf) {
                 prm->max_psize = 0;
-                goto err;
+                goto err_free_descs;
         }
 
         prm = &agdev->uac2.p_prm;
@@ -1079,17 +1092,19 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
         prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
         if (!prm->rbuf) {
                 prm->max_psize = 0;
-                goto err;
+                goto err_free_descs;
         }
 
         ret = alsa_uac2_init(agdev);
         if (ret)
-                goto err;
+                goto err_free_descs;
         return 0;
+
+err_free_descs:
+        usb_free_all_descriptors(fn);
 err:
         kfree(agdev->uac2.p_prm.rbuf);
         kfree(agdev->uac2.c_prm.rbuf);
-        usb_free_all_descriptors(fn);
         if (agdev->in_ep)
                 agdev->in_ep->driver_data = NULL;
         if (agdev->out_ep)
diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c
index e126439e4b65..945b3bd2ca98 100644
--- a/drivers/usb/gadget/function/f_uvc.c
+++ b/drivers/usb/gadget/function/f_uvc.c
@@ -279,27 +279,41 @@ uvc_function_get_alt(struct usb_function *f, unsigned interface)
         else if (interface != uvc->streaming_intf)
                 return -EINVAL;
         else
-                return uvc->state == UVC_STATE_STREAMING ? 1 : 0;
+                return uvc->video.ep->driver_data ? 1 : 0;
 }
 
 static int
 uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
 {
         struct uvc_device *uvc = to_uvc(f);
+        struct usb_composite_dev *cdev = f->config->cdev;
         struct v4l2_event v4l2_event;
         struct uvc_event *uvc_event = (void *)&v4l2_event.u.data;
         int ret;
 
-        INFO(f->config->cdev, "uvc_function_set_alt(%u, %u)\n", interface, alt);
+        INFO(cdev, "uvc_function_set_alt(%u, %u)\n", interface, alt);
 
         if (interface == uvc->control_intf) {
                 if (alt)
                         return -EINVAL;
 
+                if (uvc->control_ep->driver_data) {
+                        INFO(cdev, "reset UVC Control\n");
+                        usb_ep_disable(uvc->control_ep);
+                        uvc->control_ep->driver_data = NULL;
+                }
+
+                if (!uvc->control_ep->desc)
+                        if (config_ep_by_speed(cdev->gadget, f, uvc->control_ep))
+                                return -EINVAL;
+
+                usb_ep_enable(uvc->control_ep);
+                uvc->control_ep->driver_data = uvc;
+
                 if (uvc->state == UVC_STATE_DISCONNECTED) {
                         memset(&v4l2_event, 0, sizeof(v4l2_event));
                         v4l2_event.type = UVC_EVENT_CONNECT;
-                        uvc_event->speed = f->config->cdev->gadget->speed;
+                        uvc_event->speed = cdev->gadget->speed;
                         v4l2_event_queue(uvc->vdev, &v4l2_event);
 
                         uvc->state = UVC_STATE_CONNECTED;
@@ -321,8 +335,10 @@ uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
                 if (uvc->state != UVC_STATE_STREAMING)
                         return 0;
 
-                if (uvc->video.ep)
+                if (uvc->video.ep) {
                         usb_ep_disable(uvc->video.ep);
+                        uvc->video.ep->driver_data = NULL;
+                }
 
                 memset(&v4l2_event, 0, sizeof(v4l2_event));
                 v4l2_event.type = UVC_EVENT_STREAMOFF;
@@ -335,14 +351,22 @@ uvc_function_set_alt(struct usb_function *f, unsigned interface, unsigned alt)
                 if (uvc->state != UVC_STATE_CONNECTED)
                         return 0;
 
-                if (uvc->video.ep) {
-                        ret = config_ep_by_speed(f->config->cdev->gadget,
-                                        &(uvc->func), uvc->video.ep);
-                        if (ret)
-                                return ret;
-                        usb_ep_enable(uvc->video.ep);
+                if (!uvc->video.ep)
+                        return -EINVAL;
+
+                if (uvc->video.ep->driver_data) {
+                        INFO(cdev, "reset UVC\n");
+                        usb_ep_disable(uvc->video.ep);
+                        uvc->video.ep->driver_data = NULL;
                 }
 
+                ret = config_ep_by_speed(f->config->cdev->gadget,
+                                &(uvc->func), uvc->video.ep);
+                if (ret)
+                        return ret;
+                usb_ep_enable(uvc->video.ep);
+                uvc->video.ep->driver_data = uvc;
+
                 memset(&v4l2_event, 0, sizeof(v4l2_event));
                 v4l2_event.type = UVC_EVENT_STREAMON;
                 v4l2_event_queue(uvc->vdev, &v4l2_event);
@@ -366,6 +390,16 @@ uvc_function_disable(struct usb_function *f)
         v4l2_event_queue(uvc->vdev, &v4l2_event);
 
         uvc->state = UVC_STATE_DISCONNECTED;
+
+        if (uvc->video.ep->driver_data) {
+                usb_ep_disable(uvc->video.ep);
+                uvc->video.ep->driver_data = NULL;
+        }
+
+        if (uvc->control_ep->driver_data) {
+                usb_ep_disable(uvc->control_ep);
+                uvc->control_ep->driver_data = NULL;
+        }
 }
 
 /* --------------------------------------------------------------------------
diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index c3e1f27dbbef..9cb86bc1a9a5 100644
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -352,7 +352,8 @@ int uvcg_video_enable(struct uvc_video *video, int enable)
 
         if (!enable) {
                 for (i = 0; i < UVC_NUM_REQUESTS; ++i)
-                        usb_ep_dequeue(video->ep, video->req[i]);
+                        if (video->req[i])
+                                usb_ep_dequeue(video->ep, video->req[i]);
 
                 uvc_video_free_requests(video);
                 uvcg_queue_enable(&video->queue, 0);
diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
index 3ea287b0e448..217365d35a25 100644
--- a/drivers/usb/gadget/udc/Kconfig
+++ b/drivers/usb/gadget/udc/Kconfig
@@ -357,6 +357,7 @@ config USB_EG20T
 
 config USB_GADGET_XILINX
         tristate "Xilinx USB Driver"
+        depends on HAS_DMA
         depends on OF || COMPILE_TEST
         help
           USB peripheral controller driver for Xilinx USB2 device.
diff --git a/drivers/usb/gadget/udc/udc-core.c b/drivers/usb/gadget/udc/udc-core.c
index f107bb60a5ab..f2054659f25b 100644
--- a/drivers/usb/gadget/udc/udc-core.c
+++ b/drivers/usb/gadget/udc/udc-core.c
@@ -507,6 +507,11 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
 {
         struct usb_udc          *udc = container_of(dev, struct usb_udc, dev);
 
+        if (!udc->driver) {
+                dev_err(dev, "soft-connect without a gadget driver\n");
+                return -EOPNOTSUPP;
+        }
+
         if (sysfs_streq(buf, "connect")) {
                 usb_gadget_udc_start(udc->gadget, udc->driver);
                 usb_gadget_connect(udc->gadget);
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index a8a30b1d4167..a3ca1375dd52 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -234,7 +234,7 @@ config USB_EHCI_SH
 
 config USB_EHCI_EXYNOS
        tristate "EHCI support for Samsung S5P/EXYNOS SoC Series"
-       depends on PLAT_S5P || ARCH_EXYNOS
+       depends on ARCH_S5PV210 || ARCH_EXYNOS
        help
         Enable support for the Samsung Exynos SOC's on-chip EHCI controller.
 
@@ -550,7 +550,7 @@ config USB_OHCI_SH
 
 config USB_OHCI_EXYNOS
         tristate "OHCI support for Samsung S5P/EXYNOS SoC Series"
-        depends on PLAT_S5P || ARCH_EXYNOS
+        depends on ARCH_S5PV210 || ARCH_EXYNOS
         help
          Enable support for the Samsung Exynos SOC's on-chip OHCI controller.
 
diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
index d0d8fadf7066..1db0626c8bf4 100644
--- a/drivers/usb/host/hwa-hc.c
+++ b/drivers/usb/host/hwa-hc.c
@@ -607,7 +607,7 @@ found:
         wa->wa_descr = wa_descr = (struct usb_wa_descriptor *) hdr;
         if (le16_to_cpu(wa_descr->bcdWAVersion) > 0x0100)
                 dev_warn(dev, "Wire Adapter v%d.%d newer than groked v1.0\n",
-                         le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00 >> 8,
+                         (le16_to_cpu(wa_descr->bcdWAVersion) & 0xff00) >> 8,
                          le16_to_cpu(wa_descr->bcdWAVersion) & 0x00ff);
         result = 0;
 error:
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 280dde93abe5..9a69b1f1b300 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -128,20 +128,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                 xhci->quirks |= XHCI_AVOID_BEI;
         }
         if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
-            (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
-             pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
-                /* Workaround for occasional spurious wakeups from S5 (or
-                 * any other sleep) on Haswell machines with LPT and LPT-LP
-                 * with the new Intel BIOS
-                 */
-                /* Limit the quirk to only known vendors, as this triggers
-                 * yet another BIOS bug on some other machines
-                 * https://bugzilla.kernel.org/show_bug.cgi?id=66171
-                 */
-                if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
-                        xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
-        }
-        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
                 pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
                 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
         }
@@ -162,6 +148,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                         pdev->device == 0x3432)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
 
+        if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+                        pdev->device == 0x1042)
+                xhci->quirks |= XHCI_BROKEN_STREAMS;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c
index acdfb3e68a90..5a9b977fbc19 100644
--- a/drivers/usb/musb/musb_cppi41.c
+++ b/drivers/usb/musb/musb_cppi41.c
@@ -209,7 +209,8 @@ static enum hrtimer_restart cppi41_recheck_tx_req(struct hrtimer *timer)
                 }
         }
 
-        if (!list_empty(&controller->early_tx_list)) {
+        if (!list_empty(&controller->early_tx_list) &&
+            !hrtimer_is_queued(&controller->early_tx)) {
                 ret = HRTIMER_RESTART;
                 hrtimer_forward_now(&controller->early_tx,
                                 ktime_set(0, 20 * NSEC_PER_USEC));
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 154bcf1b5dfa..48bc09e7b83b 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -868,9 +868,15 @@ static int dsps_suspend(struct device *dev)
         struct dsps_glue *glue = dev_get_drvdata(dev);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         struct musb *musb = platform_get_drvdata(glue->musb);
-        void __iomem *mbase = musb->ctrl_base;
+        void __iomem *mbase;
 
         del_timer_sync(&glue->timer);
+
+        if (!musb)
+                /* This can happen if the musb device is in -EPROBE_DEFER */
+                return 0;
+
+        mbase = musb->ctrl_base;
         glue->context.control = dsps_readl(mbase, wrp->control);
         glue->context.epintr = dsps_readl(mbase, wrp->epintr_set);
         glue->context.coreintr = dsps_readl(mbase, wrp->coreintr_set);
@@ -887,8 +893,12 @@ static int dsps_resume(struct device *dev)
         struct dsps_glue *glue = dev_get_drvdata(dev);
         const struct dsps_musb_wrapper *wrp = glue->wrp;
         struct musb *musb = platform_get_drvdata(glue->musb);
-        void __iomem *mbase = musb->ctrl_base;
+        void __iomem *mbase;
+
+        if (!musb)
+                return 0;
 
+        mbase = musb->ctrl_base;
         dsps_writel(mbase, wrp->control, glue->context.control);
         dsps_writel(mbase, wrp->epintr_set, glue->context.epintr);
         dsps_writel(mbase, wrp->coreintr_set, glue->context.coreintr);
@@ -896,7 +906,9 @@ static int dsps_resume(struct device *dev)
         dsps_writel(mbase, wrp->mode, glue->context.mode);
         dsps_writel(mbase, wrp->tx_mode, glue->context.tx_mode);
         dsps_writel(mbase, wrp->rx_mode, glue->context.rx_mode);
-        setup_timer(&glue->timer, otg_timer, (unsigned long) musb);
+        if (musb->xceiv->state == OTG_STATE_B_IDLE &&
+            musb->port_mode == MUSB_PORT_MODE_DUAL_ROLE)
+                mod_timer(&glue->timer, jiffies + wrp->poll_seconds * HZ);
 
         return 0;
 }
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index eca1747ca8c7..cfd009dc4018 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
         { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
         { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+        { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
         { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
         { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
         { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index dc72b924c399..0dad8ce5a609 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -140,6 +140,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
  * /sys/bus/usb-serial/drivers/ftdi_sio/new_id and send a patch or report.
  */
 static const struct usb_device_id id_table_combined[] = {
+        { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
@@ -661,6 +662,8 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+        { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
         { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
         { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 5937b2d242f2..6786b705ccf6 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -30,6 +30,12 @@
 
 /*** third-party PIDs (using FTDI_VID) ***/
 
+/*
+ * Certain versions of the official Windows FTDI driver reprogrammed
+ * counterfeit FTDI devices to PID 0. Support these devices anyway.
+ */
+#define FTDI_BRICK_PID          0x0000
+
 #define FTDI_LUMEL_PD12_PID     0x6002
 
 /*
@@ -143,8 +149,12 @@
  * Xsens Technologies BV products (http://www.xsens.com).
  */
 #define XSENS_VID               0x2639
-#define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
+#define XSENS_AWINDA_STATION_PID 0x0101
+#define XSENS_AWINDA_DONGLE_PID 0x0102
 #define XSENS_MTW_PID           0x0200  /* Xsens MTw */
+#define XSENS_CONVERTER_PID     0xD00D  /* Xsens USB-serial converter */
+
+/* Xsens devices using FTDI VID */
 #define XSENS_CONVERTER_0_PID   0xD388  /* Xsens USB converter */
 #define XSENS_CONVERTER_1_PID   0xD389  /* Xsens Wireless Receiver */
 #define XSENS_CONVERTER_2_PID   0xD38A
diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
index 078f9ed419c8..02c420af251e 100644
--- a/drivers/usb/serial/kobil_sct.c
+++ b/drivers/usb/serial/kobil_sct.c
@@ -335,7 +335,8 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                         port->interrupt_out_urb->transfer_buffer_length = length;
 
                         priv->cur_pos = priv->cur_pos + length;
-                        result = usb_submit_urb(port->interrupt_out_urb, GFP_NOIO);
+                        result = usb_submit_urb(port->interrupt_out_urb,
+                                        GFP_ATOMIC);
                         dev_dbg(&port->dev, "%s - Send write URB returns: %i\n", __func__, result);
                         todo = priv->filled - priv->cur_pos;
 
@@ -350,7 +351,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
                 if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID ||
                         priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) {
                         result = usb_submit_urb(port->interrupt_in_urb,
-                                                                GFP_NOIO);
+                                        GFP_ATOMIC);
                         dev_dbg(&port->dev, "%s - Send read URB returns: %i\n", __func__, result);
                 }
         }
@@ -414,8 +415,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
         int result;
         int dtr = 0;
         int rts = 0;
-        unsigned char *transfer_buffer;
-        int transfer_buffer_length = 8;
 
         /* FIXME: locking ? */
         priv = usb_get_serial_port_data(port);
@@ -425,11 +424,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
                 return -EINVAL;
         }
 
-        /* allocate memory for transfer buffer */
-        transfer_buffer = kzalloc(transfer_buffer_length, GFP_KERNEL);
-        if (!transfer_buffer)
-                return -ENOMEM;
-
         if (set & TIOCM_RTS)
                 rts = 1;
         if (set & TIOCM_DTR)
@@ -469,7 +463,6 @@ static int kobil_tiocmset(struct tty_struct *tty,
                         KOBIL_TIMEOUT);
         }
         dev_dbg(dev, "%s - Send set_status_line URB returns: %i\n", __func__, result);
-        kfree(transfer_buffer);
         return (result < 0) ? result : 0;
 }
 
@@ -530,8 +523,6 @@ static int kobil_ioctl(struct tty_struct *tty,
 {
         struct usb_serial_port *port = tty->driver_data;
         struct kobil_private *priv = usb_get_serial_port_data(port);
-        unsigned char *transfer_buffer;
-        int transfer_buffer_length = 8;
         int result;
 
         if (priv->device_type == KOBIL_USBTWIN_PRODUCT_ID ||
@@ -541,10 +532,6 @@ static int kobil_ioctl(struct tty_struct *tty,
 
         switch (cmd) {
         case TCFLSH:
-                transfer_buffer = kmalloc(transfer_buffer_length, GFP_KERNEL);
-                if (!transfer_buffer)
-                        return -ENOBUFS;
-
                 result = usb_control_msg(port->serial->dev,
                           usb_sndctrlpipe(port->serial->dev, 0),
                           SUSBCRequest_Misc,
@@ -559,7 +546,6 @@ static int kobil_ioctl(struct tty_struct *tty,
                 dev_dbg(&port->dev,
                         "%s - Send reset_all_queues (FLUSH) URB returns: %i\n",
                         __func__, result);
-                kfree(transfer_buffer);
                 return (result < 0) ? -EIO: 0;
         default:
                 return -ENOIOCTLCMD;
diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 4856fb7e637e..4b7bfb394a32 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -215,7 +215,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         /* The connected devices do not have a bulk write endpoint,
          * to transmit data to de barcode device the control endpoint is used */
-        dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
+        dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC);
         if (!dr) {
                 count = -ENOMEM;
                 goto error_no_dr;
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index d1a3f6044c8a..7a4c21b4f676 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
 #define TELIT_PRODUCT_UE910_V2                  0x1012
 #define TELIT_PRODUCT_LE920                     0x1200
+#define TELIT_PRODUCT_LE910                     0x1201
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -362,6 +363,7 @@ static void option_instat_callback(struct urb *urb);
 
 /* Haier products */
 #define HAIER_VENDOR_ID                         0x201e
+#define HAIER_PRODUCT_CE81B                     0x10f8
 #define HAIER_PRODUCT_CE100                     0x2009
 
 /* Cinterion (formerly Siemens) products */
@@ -589,6 +591,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
         .reserved = BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info telit_le910_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(2),
+};
+
 static const struct option_blacklist_info telit_le920_blacklist = {
         .sendsetup = BIT(0),
         .reserved = BIT(1) | BIT(5),
@@ -1138,6 +1145,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+                .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
                 .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
@@ -1621,6 +1630,7 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
         { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+        { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) },
         /* Pirelli  */
         { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1, 0xff) },
         { USB_DEVICE_INTERFACE_CLASS(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2, 0xff) },
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 4bc2fc98636e..73f125e0cb58 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -52,7 +52,7 @@ int usb_stor_euscsi_init(struct us_data *us)
         us->iobuf[0] = 0x1;
         result = usb_stor_control_msg(us, us->send_ctrl_pipe,
                         0x0C, USB_RECIP_INTERFACE | USB_TYPE_VENDOR,
-                        0x01, 0x0, us->iobuf, 0x1, USB_CTRL_SET_TIMEOUT);
+                        0x01, 0x0, us->iobuf, 0x1, 5 * HZ);
         usb_stor_dbg(us, "-- result is %d\n", result);
 
         return 0;
@@ -100,7 +100,7 @@ int usb_stor_huawei_e220_init(struct us_data *us)
         result = usb_stor_control_msg(us, us->send_ctrl_pipe,
                                       USB_REQ_SET_FEATURE,
                                       USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                                      0x01, 0x0, NULL, 0x0, 1000);
+                                      0x01, 0x0, NULL, 0x0, 1 * HZ);
         usb_stor_dbg(us, "Huawei mode set result is %d\n", result);
         return 0;
 }
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index 8591d89a38e6..27e4a580d2ed 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -626,6 +626,7 @@ static int config_autodelink_after_power_on(struct us_data *us)
         return 0;
 }
 
+#ifdef CONFIG_PM
 static int config_autodelink_before_power_down(struct us_data *us)
 {
         struct rts51x_chip *chip = (struct rts51x_chip *)(us->extra);
@@ -716,6 +717,7 @@ static void fw5895_init(struct us_data *us)
                 }
         }
 }
+#endif
 
 #ifdef CONFIG_REALTEK_AUTOPM
 static void fw5895_set_mmc_wp(struct us_data *us)
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 22c7d4360fa2..b1d815eb6d0b 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1118,6 +1118,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
                  */
                 if (result == USB_STOR_XFER_LONG)
                         fake_sense = 1;
+
+                /*
+                 * Sometimes a device will mistakenly skip the data phase
+                 * and go directly to the status phase without sending a
+                 * zero-length packet.  If we get a 13-byte response here,
+                 * check whether it really is a CSW.
+                 */
+                if (result == USB_STOR_XFER_SHORT &&
+                                srb->sc_data_direction == DMA_FROM_DEVICE &&
+                                transfer_length - scsi_get_resid(srb) ==
+                                        US_BULK_CS_WRAP_LEN) {
+                        struct scatterlist *sg = NULL;
+                        unsigned int offset = 0;
+
+                        if (usb_stor_access_xfer_buf((unsigned char *) bcs,
+                                        US_BULK_CS_WRAP_LEN, srb, &sg,
+                                        &offset, FROM_XFER_BUF) ==
+                                                US_BULK_CS_WRAP_LEN &&
+                                        bcs->Signature ==
+                                                cpu_to_le32(US_BULK_CS_SIGN)) {
+                                usb_stor_dbg(us, "Device skipped data phase\n");
+                                scsi_set_resid(srb, transfer_length);
+                                goto skipped_data_phase;
+                        }
+                }
         }
 
         /* See flow chart on pg 15 of the Bulk Only Transport spec for
@@ -1153,6 +1178,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
         if (result != USB_STOR_XFER_GOOD)
                 return USB_STOR_TRANSPORT_ERROR;
 
+ skipped_data_phase:
         /* check bulk status */
         residue = le32_to_cpu(bcs->Residue);
         usb_stor_dbg(us, "Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
index 8511b54a65d9..2fefaf923e4a 100644
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -54,6 +54,20 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999,
+                "Seagate",
+                "Expansion Desk",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
+/* Reported-by: Bogdan Mihalcea <bogdan.mihalcea@infim.ro> */
+UNUSUAL_DEV(0x0bc2, 0xa003, 0x0000, 0x9999,
+                "Seagate",
+                "Backup Plus",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* https://bbs.archlinux.org/viewtopic.php?id=183190 */
 UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                 "Seagate",
@@ -61,6 +75,13 @@ UNUSUAL_DEV(0x0bc2, 0xab20, 0x0000, 0x9999,
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_NO_ATA_1X),
 
+/* https://bbs.archlinux.org/viewtopic.php?id=183190 */
+UNUSUAL_DEV(0x0bc2, 0xab21, 0x0000, 0x9999,
+                "Seagate",
+                "Backup+ BK",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
+
 /* Reported-by: Claudio Bizzarri <claudio.bizzarri@gmail.com> */
 UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
                 "JMicron",
@@ -75,3 +96,10 @@ UNUSUAL_DEV(0x174c, 0x5106, 0x0000, 0x9999,
                 "ASM1051",
                 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
                 US_FL_IGNORE_UAS),
+
+/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
+                "VIA",
+                "VL711",
+                USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+                US_FL_NO_ATA_1X),
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 69906cacd04f..a17f11850669 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -1312,6 +1312,7 @@ static int
 vhost_scsi_set_endpoint(struct vhost_scsi *vs,
                         struct vhost_scsi_target *t)
 {
+        struct se_portal_group *se_tpg;
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tpg;
         struct tcm_vhost_tpg **vs_tpg;
@@ -1359,6 +1360,21 @@ vhost_scsi_set_endpoint(struct vhost_scsi *vs,
                                 ret = -EEXIST;
                                 goto out;
                         }
+                        /*
+                         * In order to ensure individual vhost-scsi configfs
+                         * groups cannot be removed while in use by vhost ioctl,
+                         * go ahead and take an explicit se_tpg->tpg_group.cg_item
+                         * dependency now.
+                         */
+                        se_tpg = &tpg->se_tpg;
+                        ret = configfs_depend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                                   &se_tpg->tpg_group.cg_item);
+                        if (ret) {
+                                pr_warn("configfs_depend_item() failed: %d\n", ret);
+                                kfree(vs_tpg);
+                                mutex_unlock(&tpg->tv_tpg_mutex);
+                                goto out;
+                        }
                         tpg->tv_tpg_vhost_count++;
                         tpg->vhost_scsi = vs;
                         vs_tpg[tpg->tport_tpgt] = tpg;
@@ -1401,6 +1417,7 @@ static int
 vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
                           struct vhost_scsi_target *t)
 {
+        struct se_portal_group *se_tpg;
         struct tcm_vhost_tport *tv_tport;
         struct tcm_vhost_tpg *tpg;
         struct vhost_virtqueue *vq;
@@ -1449,6 +1466,13 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs,
                 vs->vs_tpg[target] = NULL;
                 match = true;
                 mutex_unlock(&tpg->tv_tpg_mutex);
+                /*
+                 * Release se_tpg->tpg_group.cg_item configfs dependency now
+                 * to allow vhost-scsi WWPN se_tpg->tpg_group shutdown to occur.
+                 */
+                se_tpg = &tpg->se_tpg;
+                configfs_undepend_item(se_tpg->se_tpg_tfo->tf_subsys,
+                                       &se_tpg->tpg_group.cg_item);
         }
         if (match) {
                 for (i = 0; i < VHOST_SCSI_MAX_VQ; i++) {
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 57b1d44acbfe..eb976ee3a02f 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -448,8 +448,10 @@ static int __init fb_console_setup(char *this_opt)
                 return 1;
 
         while ((options = strsep(&this_opt, ",")) != NULL) {
-                if (!strncmp(options, "font:", 5))
+                if (!strncmp(options, "font:", 5)) {
                         strlcpy(fontname, options + 5, sizeof(fontname));
+                        continue;
+                }
                 
                 if (!strncmp(options, "scrollback:", 11)) {
                         options += 11;
@@ -457,13 +459,9 @@ static int __init fb_console_setup(char *this_opt)
                                 fbcon_softback_size = simple_strtoul(options, &options, 0);
                                 if (*options == 'k' || *options == 'K') {
                                         fbcon_softback_size *= 1024;
-                                        options++;
                                 }
-                                if (*options != ',')
-                                        return 1;
-                                options++;
-                        } else
-                                return 1;
+                        }
+                        continue;
                 }
                 
                 if (!strncmp(options, "map:", 4)) {
@@ -478,8 +476,7 @@ static int __init fb_console_setup(char *this_opt)
 
                                 fbcon_map_override();
                         }
-
-                        return 1;
+                        continue;
                 }
 
                 if (!strncmp(options, "vc:", 3)) {
@@ -491,7 +488,8 @@ static int __init fb_console_setup(char *this_opt)
                         if (*options++ == '-')
                                 last_fb_vc = simple_strtoul(options, &options, 10) - 1;
                         fbcon_is_default = 0; 
-                }       
+                        continue;
+                }
 
                 if (!strncmp(options, "rotate:", 7)) {
                         options += 7;
@@ -499,6 +497,7 @@ static int __init fb_console_setup(char *this_opt)
                                 initial_rotation = simple_strtoul(options, &options, 0);
                         if (initial_rotation > 3)
                                 initial_rotation = 0;
+                        continue;
                 }
         }
         return 1;
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 6e6aa704fe84..517f565b65d7 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -56,7 +56,7 @@ static int cursor_size_lastfrom;
 static int cursor_size_lastto;
 static u32 vgacon_xres;
 static u32 vgacon_yres;
-static struct vgastate state;
+static struct vgastate vgastate;
 
 #define BLANK 0x0020
 
@@ -400,7 +400,7 @@ static const char *vgacon_startup(void)
 
         vga_video_num_lines = screen_info.orig_video_lines;
         vga_video_num_columns = screen_info.orig_video_cols;
-        state.vgabase = NULL;
+        vgastate.vgabase = NULL;
 
         if (screen_info.orig_video_mode == 7) {
                 /* Monochrome display */
@@ -851,12 +851,12 @@ static void vga_set_palette(struct vc_data *vc, unsigned char *table)
 {
         int i, j;
 
-        vga_w(state.vgabase, VGA_PEL_MSK, 0xff);
+        vga_w(vgastate.vgabase, VGA_PEL_MSK, 0xff);
         for (i = j = 0; i < 16; i++) {
-                vga_w(state.vgabase, VGA_PEL_IW, table[i]);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
-                vga_w(state.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_IW, table[i]);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
+                vga_w(vgastate.vgabase, VGA_PEL_D, vc->vc_palette[j++] >> 2);
         }
 }
 
@@ -1008,7 +1008,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
         switch (blank) {
         case 0:         /* Unblank */
                 if (vga_vesa_blanked) {
-                        vga_vesa_unblank(&state);
+                        vga_vesa_unblank(&vgastate);
                         vga_vesa_blanked = 0;
                 }
                 if (vga_palette_blanked) {
@@ -1022,7 +1022,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
         case 1:         /* Normal blanking */
         case -1:        /* Obsolete */
                 if (!mode_switch && vga_video_type == VIDEO_TYPE_VGAC) {
-                        vga_pal_blank(&state);
+                        vga_pal_blank(&vgastate);
                         vga_palette_blanked = 1;
                         return 0;
                 }
@@ -1034,7 +1034,7 @@ static int vgacon_blank(struct vc_data *c, int blank, int mode_switch)
                 return 1;
         default:                /* VESA blanking */
                 if (vga_video_type == VIDEO_TYPE_VGAC) {
-                        vga_vesa_blank(&state, blank - 1);
+                        vga_vesa_blank(&vgastate, blank - 1);
                         vga_vesa_blanked = blank;
                 }
                 return 0;
@@ -1280,7 +1280,7 @@ static int vgacon_font_set(struct vc_data *c, struct console_font *font, unsigne
             (charcount != 256 && charcount != 512))
                 return -EINVAL;
 
-        rc = vgacon_do_font_op(&state, font->data, 1, charcount == 512);
+        rc = vgacon_do_font_op(&vgastate, font->data, 1, charcount == 512);
         if (rc)
                 return rc;
 
@@ -1299,7 +1299,7 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font)
         font->charcount = vga_512_chars ? 512 : 256;
         if (!font->data)
                 return 0;
-        return vgacon_do_font_op(&state, font->data, 0, vga_512_chars);
+        return vgacon_do_font_op(&vgastate, font->data, 0, vga_512_chars);
 }
 
 #else
diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c
index 3bf403150a2d..9ec81d46fc57 100644
--- a/drivers/video/fbdev/atmel_lcdfb.c
+++ b/drivers/video/fbdev/atmel_lcdfb.c
@@ -27,7 +27,6 @@
 #include <linux/regulator/consumer.h>
 #include <video/videomode.h>
 
-#include <mach/cpu.h>
 #include <asm/gpio.h>
 
 #include <video/atmel_lcdc.h>
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
index 5ee3b5505f7f..91921665b98b 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-analog-tv.c
@@ -301,6 +301,8 @@ static const struct of_device_id tvc_of_match[] = {
         {},
 };
 
+MODULE_DEVICE_TABLE(of, tvc_of_match);
+
 static struct platform_driver tvc_connector_driver = {
         .probe  = tvc_probe,
         .remove = __exit_p(tvc_remove),
@@ -308,6 +310,7 @@ static struct platform_driver tvc_connector_driver = {
                 .name   = "connector-analog-tv",
                 .owner  = THIS_MODULE,
                 .of_match_table = tvc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
index 74de2bc50c4f..2dfb6e5ff0cc 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-dvi.c
@@ -391,6 +391,7 @@ static struct platform_driver dvi_connector_driver = {
                 .name   = "connector-dvi",
                 .owner  = THIS_MODULE,
                 .of_match_table = dvic_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
index 131c6e260898..7b25967a91eb 100644
--- a/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
+++ b/drivers/video/fbdev/omap2/displays-new/connector-hdmi.c
@@ -437,6 +437,7 @@ static struct platform_driver hdmi_connector_driver = {
                 .name   = "connector-hdmi",
                 .owner  = THIS_MODULE,
                 .of_match_table = hdmic_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
index b4e9a42a79e6..47ee7cdee1c5 100644
--- a/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tfp410.c
@@ -298,6 +298,7 @@ static struct platform_driver tfp410_driver = {
                 .name   = "tfp410",
                 .owner  = THIS_MODULE,
                 .of_match_table = tfp410_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
index c891d8f84cb2..c4abd56dd846 100644
--- a/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
+++ b/drivers/video/fbdev/omap2/displays-new/encoder-tpd12s015.c
@@ -461,6 +461,7 @@ static struct platform_driver tpd_driver = {
                 .name   = "tpd12s015",
                 .owner  = THIS_MODULE,
                 .of_match_table = tpd_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-dpi.c b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
index 3636b61dc9b4..a9c3dcf0f6b5 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dpi.c
@@ -327,6 +327,7 @@ static struct platform_driver panel_dpi_driver = {
                 .name = "panel-dpi",
                 .owner = THIS_MODULE,
                 .of_match_table = panel_dpi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
index d6f14e8717e8..899cb1ab523d 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-dsi-cm.c
@@ -1378,6 +1378,7 @@ static struct platform_driver dsicm_driver = {
                 .name = "panel-dsi-cm",
                 .owner = THIS_MODULE,
                 .of_match_table = dsicm_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
index cc5b5124e0b4..27d4fcfa1824 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-lgphilips-lb035q02.c
@@ -394,6 +394,7 @@ static struct spi_driver lb035q02_spi_driver = {
                 .name   = "panel_lgphilips_lb035q02",
                 .owner  = THIS_MODULE,
                 .of_match_table = lb035q02_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
index 3595f111aa35..ccf3f4f3c703 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-nec-nl8048hl11.c
@@ -424,6 +424,7 @@ static struct spi_driver nec_8048_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = NEC_8048_PM_OPS,
                 .of_match_table = nec_8048_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = nec_8048_probe,
         .remove = nec_8048_remove,
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
index f1f72ce50a17..234142cc3764 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sharp-ls037v7dw01.c
@@ -410,6 +410,7 @@ static struct platform_driver sharp_ls_driver = {
                 .name = "panel-sharp-ls037v7dw01",
                 .owner = THIS_MODULE,
                 .of_match_table = sharp_ls_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
index 617f8d2f5127..337ccc5c0f5e 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-sony-acx565akm.c
@@ -904,6 +904,7 @@ static struct spi_driver acx565akm_driver = {
                 .name   = "acx565akm",
                 .owner  = THIS_MODULE,
                 .of_match_table = acx565akm_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = acx565akm_probe,
         .remove = acx565akm_remove,
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
index 728808bcceeb..fbba0b8ca871 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td028ttec1.c
@@ -500,6 +500,7 @@ static struct spi_driver td028ttec1_spi_driver = {
                 .name   = "panel-tpo-td028ttec1",
                 .owner  = THIS_MODULE,
                 .of_match_table = td028ttec1_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
index de78ab0caaa8..5aba76bca25a 100644
--- a/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
+++ b/drivers/video/fbdev/omap2/displays-new/panel-tpo-td043mtea1.c
@@ -673,6 +673,7 @@ static struct spi_driver tpo_td043_spi_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &tpo_td043_spi_pm,
                 .of_match_table = tpo_td043_of_match,
+                .suppress_bind_attrs = true,
         },
         .probe  = tpo_td043_probe,
         .remove = tpo_td043_remove,
diff --git a/drivers/video/fbdev/omap2/dss/apply.c b/drivers/video/fbdev/omap2/dss/apply.c
index 0a0b084ce65d..663ccc3bf4e5 100644
--- a/drivers/video/fbdev/omap2/dss/apply.c
+++ b/drivers/video/fbdev/omap2/dss/apply.c
@@ -1132,6 +1132,8 @@ static void dss_mgr_disable_compat(struct omap_overlay_manager *mgr)
         if (!mp->enabled)
                 goto out;
 
+        wait_pending_extra_info_updates();
+
         if (!mgr_manual_update(mgr))
                 dispc_mgr_disable_sync(mgr->id);
 
diff --git a/drivers/video/fbdev/omap2/dss/dispc.c b/drivers/video/fbdev/omap2/dss/dispc.c
index be053aa80880..0e9a74bb9fc2 100644
--- a/drivers/video/fbdev/omap2/dss/dispc.c
+++ b/drivers/video/fbdev/omap2/dss/dispc.c
@@ -3290,8 +3290,11 @@ static void dispc_dump_regs(struct seq_file *s)
                 DUMPREG(i, DISPC_OVL_FIFO_SIZE_STATUS);
                 DUMPREG(i, DISPC_OVL_ROW_INC);
                 DUMPREG(i, DISPC_OVL_PIXEL_INC);
+
                 if (dss_has_feature(FEAT_PRELOAD))
                         DUMPREG(i, DISPC_OVL_PRELOAD);
+                if (dss_has_feature(FEAT_MFLAG))
+                        DUMPREG(i, DISPC_OVL_MFLAG_THRESHOLD);
 
                 if (i == OMAP_DSS_GFX) {
                         DUMPREG(i, DISPC_OVL_WINDOW_SKIP);
@@ -3312,10 +3315,6 @@ static void dispc_dump_regs(struct seq_file *s)
                 }
                 if (dss_has_feature(FEAT_ATTR2))
                         DUMPREG(i, DISPC_OVL_ATTRIBUTES2);
-                if (dss_has_feature(FEAT_PRELOAD))
-                        DUMPREG(i, DISPC_OVL_PRELOAD);
-                if (dss_has_feature(FEAT_MFLAG))
-                        DUMPREG(i, DISPC_OVL_MFLAG_THRESHOLD);
         }
 
 #undef DISPC_REG
@@ -3843,6 +3842,7 @@ static struct platform_driver omap_dispchw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dispc_pm_ops,
                 .of_match_table = dispc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dispc.h b/drivers/video/fbdev/omap2/dss/dispc.h
index 78edb449c763..3043d6e0a5f9 100644
--- a/drivers/video/fbdev/omap2/dss/dispc.h
+++ b/drivers/video/fbdev/omap2/dss/dispc.h
@@ -101,8 +101,7 @@
                                         DISPC_FIR_COEF_V2_OFFSET(n, i))
 #define DISPC_OVL_PRELOAD(n)            (DISPC_OVL_BASE(n) + \
                                         DISPC_PRELOAD_OFFSET(n))
-#define DISPC_OVL_MFLAG_THRESHOLD(n)    (DISPC_OVL_BASE(n) + \
-                                        DISPC_MFLAG_THRESHOLD_OFFSET(n))
+#define DISPC_OVL_MFLAG_THRESHOLD(n)    DISPC_MFLAG_THRESHOLD_OFFSET(n)
 
 /* DISPC up/downsampling FIR filter coefficient structure */
 struct dispc_coef {
diff --git a/drivers/video/fbdev/omap2/dss/dpi.c b/drivers/video/fbdev/omap2/dss/dpi.c
index 9368972d6962..4a3363dae74a 100644
--- a/drivers/video/fbdev/omap2/dss/dpi.c
+++ b/drivers/video/fbdev/omap2/dss/dpi.c
@@ -720,6 +720,7 @@ static struct platform_driver omap_dpi_driver = {
         .driver         = {
                 .name   = "omapdss_dpi",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dsi.c b/drivers/video/fbdev/omap2/dss/dsi.c
index b6f6ae1d4664..0793bc67a275 100644
--- a/drivers/video/fbdev/omap2/dss/dsi.c
+++ b/drivers/video/fbdev/omap2/dss/dsi.c
@@ -1603,7 +1603,7 @@ int dsi_pll_set_clock_div(struct platform_device *dsidev,
         } else if (dss_has_feature(FEAT_DSI_PLL_SELFREQDCO)) {
                 f = cinfo->clkin4ddr < 1000000000 ? 0x2 : 0x4;
 
-                l = FLD_MOD(l, f, 4, 1);        /* PLL_SELFREQDCO */
+                l = FLD_MOD(l, f, 3, 1);        /* PLL_SELFREQDCO */
         }
 
         l = FLD_MOD(l, 1, 13, 13);              /* DSI_PLL_REFEN */
@@ -5754,6 +5754,7 @@ static struct platform_driver omap_dsihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dsi_pm_ops,
                 .of_match_table = dsi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/dss.c b/drivers/video/fbdev/omap2/dss/dss.c
index 6daeb7ed44c6..14bcd6c43f72 100644
--- a/drivers/video/fbdev/omap2/dss/dss.c
+++ b/drivers/video/fbdev/omap2/dss/dss.c
@@ -966,6 +966,7 @@ static struct platform_driver omap_dsshw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &dss_pm_ops,
                 .of_match_table = dss_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi4.c b/drivers/video/fbdev/omap2/dss/hdmi4.c
index 6a8550cf43e5..9a8713ca090c 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi4.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi4.c
@@ -781,6 +781,7 @@ static struct platform_driver omapdss_hdmihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi5.c b/drivers/video/fbdev/omap2/dss/hdmi5.c
index 32d02ec34d23..169b764bb9d4 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi5.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi5.c
@@ -806,6 +806,7 @@ static struct platform_driver omapdss_hdmihw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &hdmi_pm_ops,
                 .of_match_table = hdmi_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/hdmi_pll.c b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
index 54df12a8d744..6d92bb32fe51 100644
--- a/drivers/video/fbdev/omap2/dss/hdmi_pll.c
+++ b/drivers/video/fbdev/omap2/dss/hdmi_pll.c
@@ -124,16 +124,15 @@ static int hdmi_pll_config(struct hdmi_pll_data *pll)
         r = FLD_MOD(r, 0x0, 14, 14);    /* PHY_CLKINEN de-assert during locking */
         r = FLD_MOD(r, fmt->refsel, 22, 21);    /* REFSEL */
 
-        if (fmt->dcofreq) {
-                /* divider programming for frequency beyond 1000Mhz */
-                REG_FLD_MOD(pll->base, PLLCTRL_CFG3, fmt->regsd, 17, 10);
+        if (fmt->dcofreq)
                 r = FLD_MOD(r, 0x4, 3, 1);      /* 1000MHz and 2000MHz */
-        } else {
+        else
                 r = FLD_MOD(r, 0x2, 3, 1);      /* 500MHz and 1000MHz */
-        }
 
         hdmi_write_reg(pll->base, PLLCTRL_CFG2, r);
 
+        REG_FLD_MOD(pll->base, PLLCTRL_CFG3, fmt->regsd, 17, 10);
+
         r = hdmi_read_reg(pll->base, PLLCTRL_CFG4);
         r = FLD_MOD(r, fmt->regm2, 24, 18);
         r = FLD_MOD(r, fmt->regmf, 17, 0);
@@ -144,8 +143,8 @@ static int hdmi_pll_config(struct hdmi_pll_data *pll)
 
         /* wait for bit change */
         if (hdmi_wait_for_bit_change(pll->base, PLLCTRL_PLL_GO,
-                        0, 0, 1) != 1) {
-                DSSERR("PLL GO bit not set\n");
+                        0, 0, 0) != 0) {
+                DSSERR("PLL GO bit not clearing\n");
                 return -ETIMEDOUT;
         }
 
diff --git a/drivers/video/fbdev/omap2/dss/rfbi.c b/drivers/video/fbdev/omap2/dss/rfbi.c
index c8a81a2b879c..878273f58839 100644
--- a/drivers/video/fbdev/omap2/dss/rfbi.c
+++ b/drivers/video/fbdev/omap2/dss/rfbi.c
@@ -1044,6 +1044,7 @@ static struct platform_driver omap_rfbihw_driver = {
                 .name   = "omapdss_rfbi",
                 .owner  = THIS_MODULE,
                 .pm     = &rfbi_pm_ops,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/sdi.c b/drivers/video/fbdev/omap2/dss/sdi.c
index 911dcc9173a6..4c9c46d4ea60 100644
--- a/drivers/video/fbdev/omap2/dss/sdi.c
+++ b/drivers/video/fbdev/omap2/dss/sdi.c
@@ -377,6 +377,7 @@ static struct platform_driver omap_sdi_driver = {
         .driver         = {
                 .name   = "omapdss_sdi",
                 .owner  = THIS_MODULE,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/dss/venc.c b/drivers/video/fbdev/omap2/dss/venc.c
index 21d81113962b..d077d8a75ddc 100644
--- a/drivers/video/fbdev/omap2/dss/venc.c
+++ b/drivers/video/fbdev/omap2/dss/venc.c
@@ -966,6 +966,7 @@ static struct platform_driver omap_venchw_driver = {
                 .owner  = THIS_MODULE,
                 .pm     = &venc_pm_ops,
                 .of_match_table = venc_of_match,
+                .suppress_bind_attrs = true,
         },
 };
 
diff --git a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
index 15872433e0c6..ce8a70570756 100644
--- a/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
+++ b/drivers/video/fbdev/omap2/omapfb/omapfb-main.c
@@ -1833,14 +1833,13 @@ static void omapfb_free_resources(struct omapfb2_device *fbdev)
         if (fbdev == NULL)
                 return;
 
-        for (i = 0; i < fbdev->num_fbs; i++) {
-                struct omapfb_info *ofbi = FB2OFB(fbdev->fbs[i]);
-                int j;
+        for (i = 0; i < fbdev->num_overlays; i++) {
+                struct omap_overlay *ovl = fbdev->overlays[i];
 
-                for (j = 0; j < ofbi->num_overlays; j++) {
-                        struct omap_overlay *ovl = ofbi->overlays[j];
-                        ovl->disable(ovl);
-                }
+                ovl->disable(ovl);
+
+                if (ovl->manager)
+                        ovl->unset_manager(ovl);
         }
 
         for (i = 0; i < fbdev->num_fbs; i++)
@@ -2619,7 +2618,7 @@ err0:
         return r;
 }
 
-static int __exit omapfb_remove(struct platform_device *pdev)
+static int omapfb_remove(struct platform_device *pdev)
 {
         struct omapfb2_device *fbdev = platform_get_drvdata(pdev);
 
@@ -2636,7 +2635,7 @@ static int __exit omapfb_remove(struct platform_device *pdev)
 
 static struct platform_driver omapfb_driver = {
         .probe          = omapfb_probe,
-        .remove         = __exit_p(omapfb_remove),
+        .remove         = omapfb_remove,
         .driver         = {
                 .name   = "omapfb",
                 .owner  = THIS_MODULE,
@@ -2651,6 +2650,7 @@ module_param_named(mirror, def_mirror, bool, 0);
 
 module_platform_driver(omapfb_driver);
 
+MODULE_ALIAS("platform:omapfb");
 MODULE_AUTHOR("Tomi Valkeinen <tomi.valkeinen@nokia.com>");
 MODULE_DESCRIPTION("OMAP2/3 Framebuffer");
 MODULE_LICENSE("GPL v2");